feat(adapter-codex-local): add device-login proof CLI

Wire the Daytona SDK to the injected SandboxLoginDriver and prove the device
login end to end. Require a Daytona environment id argument and fail loud when it
is absent, when no controlling terminal exists, or when the environment provider
is not daytona. Stream the login output in memory through a non-persisting exec
path, write the URL and the code only to the controlling terminal, install the
credential into a run-scoped proof home, and run a second sandbox that uses the
saved credential. Delete the proof home and every sandbox in a finally block on
every terminal path.

Resolve the environment record through the workspace database client (a
devDependency). Load the Daytona SDK through a dynamic import against a local
interface, so the adapter never declares the heavy SDK dependency; a live run
installs @daytonaio/sdk or sets PAPERCLIP_DAYTONA_SDK_MODULE.

Co-authored-by: Paperclip <noreply@paperclip.ing>

Author: nickyleach

packages/adapters/codex-local/package.json

@@ -49,15 +49,18 @@
     "build": "tsc && cp src/server/codex-auth-merge-decision.cjs src/server/codex-auth-merge-extract.sh dist/server/",
     "clean": "rm -rf dist",
     "typecheck": "tsc --noEmit",
-    "probe:quota": "pnpm exec tsx src/cli/quota-probe.ts --json"
+    "probe:quota": "pnpm exec tsx src/cli/quota-probe.ts --json",
+    "proof:device-login": "pnpm exec tsx src/cli/device-login-proof.ts"
   },
   "dependencies": {
     "@agentclientprotocol/codex-acp": "^1.1.4",
     "@paperclipai/adapter-utils": "workspace:*",
     "picocolors": "^1.1.1"
   },
   "devDependencies": {
+    "@paperclipai/db": "workspace:*",
     "@types/node": "^22.20.1",
+    "drizzle-orm": "^0.45.2",
     "typescript": "^5.7.3"
   }
 }