docs(codex): add Hermes-aware recovery branch for refresh_token_reused (#1542)

[0xDevNinja]

Summary

• /codex Error Handling currently funnels every auth error to codex login. refresh_token_reused is the one case where that's actively destructive: Hermes' openai-codex provider can still be serving valid tokens while ~/.codex/auth.json has gone stale (split-brain auth), and codex login wipes the working Hermes session.
• This PR adds a sub-bullet under Error Handling > Auth that branches on a Hermes smoke test before suggesting any auth repair, mirroring the runbook the reporter is using downstream.

Fixes #1542.

Behavior

The new bullet adds three steps in order:

1. Smoke-test the Hermes openai-codex provider (if Hermes is installed) before doing anything else.
2. If Hermes works, repair ~/.codex/auth.json from the Hermes-side tokens, chmod 600, retest codex exec — no codex login needed.
3. If Hermes is absent or also down, the OpenAI session itself is gone and codex login is the right next step.

The skill is also told to tell the user which branch it took before acting, so the user knows whether they're about to nuke a working Hermes session.

Scope

Doc-only: edit to codex/SKILL.md.tmpl Error Handling section, plus the regenerated codex/SKILL.md (via bun run gen:skill-docs). No code, no auth surface, no tests added — same shape as bun run gen:skill-docs template-only doc PRs that have shipped before. The reporter's notes call this out explicitly: "This is documentation/runbook guidance only; it does not change Codex or Hermes auth behavior."

bun test test/skill-validation.test.ts test/gen-skill-docs.test.ts
# 707 pass, 7 fail

The 7 failures are the pre-existing --dry-run freshness check cases on non-Claude hosts (Kiro/OpenCode/Slate/Cursor/OpenClaw/Hermes/GBrain) that reproduce on upstream/main with this branch's changes stashed — unrelated to this patch.

Out of scope

• Wiring an actual Hermes-side codex-auth-sync helper into gstack. The reporter notes the exact helper script varies by Hermes version; bundling one here would lock us to a specific Hermes layout. Pointing at the helper in prose keeps both sides flexible.
• Auto-detecting Hermes install state. The skill prose says "if Hermes is installed" and lets Claude probe; a hard command -v hermes check could move into Step 0 in a follow-up if maintainers prefer.