fix(review): codex discovery honors CODEX_HOME (Bugbot finding)

Discovery walked ~/.codex via UserHomeDir while every other codex-agent path resolves through resolveCodexHome, which honors CODEX_HOME — so skills installed under a custom codex home were invisible to discovery and spawn-time validation rejected saved $skills as 'not installed' even though codex itself finds and runs them. Discovery now uses the canonical resolution; the fake-home test helper also pins CODEX_HOME empty so a dev shell's value can't leak into the hermetic tests.