chore: migrate codex transport from MCP to CLI

- _shared/review-contract.md: §9 now mandates `codex exec` for R1 + `codex exec resume <thread_id>` for R2/R3, with explicit session retention (R1 captures thread_id, later rounds resume — never start a fresh session for the same job). §10 swaps `mcp__codex__codex(-reply)` tool grants for `Bash` on the two codex reviewer agents.
- spec-multi-reviewer.md: line 23 prose updated — orchestrator no longer talks to codex directly; all codex interaction is delegated to the codex-doc-review / codex-implementation-review sub-agents which own `codex exec` + resume.
- findings-synthesizer.md: Phase 3.5 reconciliation path describes `codex exec resume <threadId>` as the future v1.1 mechanism. Phase 3.5 stays disabled in v1.0 — Hard Constraint contains-studio#4 (no Bash) preserved; frontmatter unchanged.

Defaults: reasoning effort `high` via `-c model_reasoning_effort=high` on R1 (R2 inherits). Model is NOT pinned — agents let the codex CLI pick from `~/.codex/config.toml` and only pass `-m` when the orchestrator was given an explicit `--codex-model` override.

Prompt convention: `/review <target>` is documented as a contract-level prefix on the free-form prompt, NOT a real codex CLI slash command (codex's `review` subcommand operates on git diffs, which is not appropriate for adversarial spec/file review). Reviewer agents prepend `/review` as a textual signal for consistency.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: lancer-code