feat: codex app-server integration, token sync fix, typing fix

- Rewrite codex-runner to use `codex app-server` JSON-RPC instead of
  `codex exec`. Supports streaming (item/agentMessage/delta), session
  persistence (thread/start, thread/resume), and mid-turn message
  injection (turn/steer with IPC polling during execution).
- Fix token refresh not syncing to per-group session directories,
  causing 401 errors on running agents.
- Fix typing indicator staying on when codex returns null result
  by always clearing typing on any streaming callback.
- Update README and CLAUDE.md to reflect dual-service architecture,
  host process mode, and codex app-server integration.

src/container-runner.ts

@@ -275,10 +275,7 @@ function prepareGroupEnvironment(
         ? fs.readFileSync(configTomlPath, 'utf-8')
         : '';
       // Remove existing nanoclaw MCP section if present (to refresh env vars)
-      toml = toml.replace(
-        /\n?\[mcp_servers\.nanoclaw\][\s\S]*?(?=\n\[|$)/,
-        '',
-      );
+      toml = toml.replace(/\n?\[mcp_servers\.nanoclaw\][\s\S]*?(?=\n\[|$)/, '');
       const mcpSection = `
 [mcp_servers.nanoclaw]
 command = "node"