Add Codex token refresher CronJob

[gjkim42]

Summary

• add a Go-based token refresher that reads Codex auth.json from a Kubernetes Secret, refreshes it in an isolated temp HOME, and writes the Secret back only when auth changes
• add Docker, Makefile, CI workflow, and Kubernetes CronJob/RBAC manifests for a 12-hour refresh schedule
• document setup, configuration, and the provider-oriented structure for future agent support

Testing

• make verify