Docs: record Codex MCP baseline PASS

[raelovejoy]

Summary

• record a redacted real-machine PASS for Codex CLI → local stdio MCP → Relmote Agent Host → paired Target;
• promote the MCP/Codex adapter to implemented and exercised status for the validated Linux path;
• mark real Codex connection and read/exec/revocation boundary tests complete in the roadmap;
• preserve privacy by omitting personal hostnames, usernames, private addresses, pairing codes, and bearer credentials.

Observed boundary

Codex correctly distinguished Agent Host from Target, used only Relmote MCP tools, respected denial when terminal.exec was absent, executed git_status only after an explicit target grant, and stopped after target-side revocation without attempting an alternate route.