Make Open Alice truly Codex-driven

[zcs107992-design]

Summary

• switch the Codex backend from the old HTTP bridge to local codex exec with Open Alice MCP mounted into the Codex session
• make Codex CLI the default provider in config, presets, UI copy, and README, and add Windows launch/build workflow fixes for daily use
• patch the remaining runtime dependency advisories so pnpm audit --prod is clean while tests and builds still pass

Validation

• corepack pnpm test
• corepack pnpm build
• corepack pnpm audit --prod
• smoke-tested startup and /api/config/profiles/test using the default Codex profile

[zcs107992-design]

Rebased by merging the latest upstream \master\ into this branch and resolving the README/package.json conflicts. Re-verified on the merged branch:

• \corepack pnpm test\ -> 53 files, 1004 tests passed
• \corepack pnpm build\ -> passed
• \corepack pnpm audit --prod\ -> no known vulnerabilities

The PR is now mergeable from a content/conflict perspective. I do not have permission to execute the final merge into \TraderAlice/OpenAlice\, so the last remaining step is a maintainer-side merge click.

[zcs107992-design]

@luokerenx4 This is now fully rebased onto the latest \master\, conflict-free, and re-verified locally:\n\n- \corepack pnpm test\ -> 53 files / 1004 tests passed\n- \corepack pnpm build\ -> passed\n- \corepack pnpm audit --prod\ -> clean\n\nI do not have permission to execute the final merge into \TraderAlice/OpenAlice\, but the PR itself is ready from the code/conflict side.

[zcs107992-design]

Re-verified on April 15, 2026 after the latest upstream master moved to 091f744:

• PR branch is still ahead 3 / behind 0 relative to TraderAlice:master
• local startup smoke passed with node dist/main.js
• GET /api/config/profiles -> ok
• POST /api/config/profiles/test with the default Codex profile -> ok ("Hi. I?m Alice. What do you want to work on?")
• embedded market-data server GET /api/v1/health on port 6901 -> ok

I also retried the final merge, but the current account still does not have MergePullRequest permission on TraderAlice/OpenAlice. From the contributor side, this is ready for a maintainer-side merge.