Summary

• Use live OpenAI Codex model discovery for the authenticated model picker instead of the static curated fallback list.
• Refresh Codex fallback defaults to the current live lineup: gpt-5.5, gpt-5.4, gpt-5.4-mini, gpt-5.3-codex, gpt-5.2.
• Add regression coverage so stale Codex slugs are not shown when live discovery is available.

Test Plan

• venv/bin/python -m pytest tests/hermes_cli/test_codex_models.py tests/hermes_cli/test_codex_cli_model_picker.py -q
• venv/bin/python -m pytest tests/hermes_cli/test_codex_models.py tests/hermes_cli/test_codex_cli_model_picker.py tests/hermes_cli/test_user_providers_model_switch.py tests/hermes_cli/test_model_switch_custom_providers.py -q

Live verification

• provider_model_ids('openai-codex', force_refresh=True) returned: ['gpt-5.5', 'gpt-5.4', 'gpt-5.4-mini', 'gpt-5.3-codex', 'gpt-5.2']
• list_authenticated_providers(..., current_provider='openai-codex') now returns the same five Codex models.