fix(codex-runtime): re-running /codex-runtime codex_app_server when already enabled now triggers migration

The /codex-runtime slash command short-circuits with "openai_runtime
already set" when invoked with the same value as the current config,
and crucially skips the entire migration block below. The check
conflates two things: (a) "the config value is correct" and (b) "the
world state (managed block in ~/.codex/config.toml, hermes-tools MCP
callback, plugin discovery) is converged".

Common footgun this exposes: a user who pre-sets
`model.openai_runtime: codex_app_server` directly in config.yaml
(reasonable thing to do) and then runs /codex-runtime codex_app_server
to trigger migration sees "already set" and silently gets no migration.
~/.codex/config.toml never receives the managed block, the hermes-tools
MCP callback never registers, and codex falls through to its default
runtime instead of the app-server one — visibly successful but
functionally partial setup.

The migration is idempotent by design (it replaces its own managed
block in place between MIGRATION_MARKER and MIGRATION_END_MARKER), so
re-running it is safe and cheap. Fix the short-circuit to fall through
to migration when re-applying codex_app_server while skipping the
config persist (no value-level change needed). The disable case
(re-applying "auto") still short-circuits because disabling doesn't
touch ~/.codex/config.toml at all.

The user-visible message changes to "openai_runtime already set to
codex_app_server — re-applying migration" so re-runs surface what
happened.

Regression test (test_reapply_codex_app_server_runs_migration) asserts:
- migrate() was called when re-applying
- persist_callback was NOT called (no config write on no-op transitions)
- migration output (MCP servers, sandbox default) surfaces in the
  user-visible message
- requires_new_session is True so callers know to /reset

Verified RED→GREEN: the test fails on origin/main with
"migration must run on reapply, not just first enable" and passes with
this fix. Full test_codex_runtime_switch.py suite: 31 passed.

hermes_cli/codex_runtime_switch.py

@@ -144,8 +144,19 @@ def apply(
             codex_version=ver if ok else None,
         )
 
-    # No change requested
-    if new_value == current:
+    # No-config-change paths. For `auto` we return immediately — disabling
+    # doesn't touch ~/.codex/. For `codex_app_server`, we fall through to
+    # the migration block below: the config value is already correct, but
+    # the world state (managed block in ~/.codex/config.toml, hermes-tools
+    # MCP callback, plugin discovery) may be stale or missing — common
+    # footgun when users pre-set `openai_runtime: codex_app_server` in
+    # config.yaml without ever running the slash command. The migration is
+    # idempotent by design (it replaces its own managed block in place), so
+    # re-running is cheap and safe.
+    reapplying_enable = (
+        new_value == current and new_value == "codex_app_server"
+    )
+    if new_value == current and not reapplying_enable:
         return CodexRuntimeStatus(
             success=True,
             new_value=current,
@@ -172,22 +183,28 @@ def apply(
                 codex_version=None,
             )
 
-    set_runtime(config, new_value)
-    if persist_callback is not None:
-        try:
-            persist_callback(config)
-        except Exception as exc:
-            logger.exception("failed to persist openai_runtime change")
-            return CodexRuntimeStatus(
-                success=False,
-                new_value=new_value,
-                old_value=current,
-                message=f"updated config in memory but persist failed: {exc}",
-            )
+    if not reapplying_enable:
+        set_runtime(config, new_value)
+        if persist_callback is not None:
+            try:
+                persist_callback(config)
+            except Exception as exc:
+                logger.exception("failed to persist openai_runtime change")
+                return CodexRuntimeStatus(
+                    success=False,
+                    new_value=new_value,
+                    old_value=current,
+                    message=f"updated config in memory but persist failed: {exc}",
+                )
 
-    msg_lines = [
-        f"openai_runtime: {current} → {new_value}",
-    ]
+    if reapplying_enable:
+        msg_lines = [
+            f"openai_runtime already set to {current} — re-applying migration",
+        ]
+    else:
+        msg_lines = [
+            f"openai_runtime: {current} → {new_value}",
+        ]
     if new_value == "codex_app_server":
         ok, ver = _check_binary_cached()
         if ok: