fix(cross-model): discover the Codex.app-bundled codex CLI and name the peer-CLI requirement

[tmchow]

Summary

Fixes #1272.

On a machine where Codex is installed only as the desktop app, the cross-model pass in ce-code-review (and ce-doc-review, ce-pov, ce-work) silently reported "cross-model pass: not run". Codex.app ships a working codex at Contents/Resources/codex but does not link it onto PATH, and peer discovery was command -v only.

Now, when no codex is on PATH, each worker probes the known Codex.app bundle dirs (~/Applications and /Applications; CROSS_MODEL_CODEX_APP_DIRS overrides) and appends the first hit. Append, never prepend: a PATH-installed CLI stays authoritative. The "no peer reachable" skip line now names the peer CLIs (codex, claude, grok, cursor-agent) and says an API key alone does not enable the pass, so a fresh machine explains itself instead of failing quietly.

Docs (docs/skills/ce-code-review.md, pointer in ce-doc-review.md) now state the peer-CLI prerequisite, the app-bundle discovery, and that Gemini has no standalone target (issue items 1 and 3). Item 2 — a one-time install check — belongs to the installer in src/ and is left for a separate change.

Validation

• One regression test per worker script: a stub codex inside a Codex.app/Contents/Resources fixture with none on PATH resolves and is invoked. Each fails on main.
• A precedence test proves the PATH stub is invoked over the bundle stub.
• Test sandboxes now mask any real Codex.app on the host, so the suite is host-independent.
• bun run test: 3117 pass. bun run release:validate in sync.
• Reviewed with ce-code-review including an independent Codex cross-model adversarial pass; all its findings (test hermeticity) were applied before this PR.

Known residuals (advisory)

• The probe checks -x, not that the bundled binary executes; a broken bundle would fail at invocation with a less tidy message than today's skip.
• docs/skills/ce-pov.md and ce-work.md do not yet carry the prerequisite note.

Security Disclosure

Shell change in four skill worker scripts: when codex is absent from PATH, the script appends a fixed, well-known app-bundle directory (or an explicit CROSS_MODEL_CODEX_APP_DIRS value) to PATH. Append-only, so an existing PATH binary always wins; the lookup under $HOME follows the same trust model as PATH itself. No secrets, permissions, or converter output changed.

Agent Disclosure

• Model: Claude Code · claude-fable-5

---

[cursor]

PR Summary

^{Cursor Bugbot is generating a summary for commit 64785ae. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 64785ae. Configure here.}