Fix codex user and isolate instance homes - #4

Summary

Fixes named-instance runtime isolation after real parallel-use testing showed that instances shared the same mounted Codex home.

Changes:

• add a real non-root codex user and /home/codex/.codex to the base image
• preserve existing launcher host UID/GID behavior for workspace write compatibility
• keep default no-instance Codex home unchanged
• use per-project/per-instance Codex homes for explicit --instance / CODEXCLI_INSTANCE
• seed new instance homes from the default Codex home on first use
• expand doctor output with project key, selected Codex home, home source, writable status, and user expectation
• add runtime-home shell tests
• extend CI with runtime tests and image user checks

Verification

Local:

• bash -n scripts/*
• bash -n tests/*
• shellcheck -x scripts/* tests/*
• bash tests/runtime-home-selection.sh
• podman build -t codexcli-runtime-ci-smoke .
• podman run --rm codexcli-runtime-ci-smoke getent passwd codex
• podman run --rm codexcli-runtime-ci-smoke id
• podman run --rm codexcli-runtime-ci-smoke sh -lc 'test -d /home/codex/.codex && test -w /home/codex/.codex'
• manual parallel-container inspect confirmed different /home/codex/.codex host mounts for review/docs instances
• git diff --check

Notes

This patch intentionally does not redesign the launcher user model. The launcher still uses host UID/GID for bind-mounted workspace compatibility. A later branch can evaluate a cleaner long-term user model separately.