fix: remove env_key from injected Codex provider — fixes #393

Codex treats env_key as a hard requirement: if the named env var is
absent it throws "Missing environment variable" before the session
starts. Subscription (ChatGPT Plus) users don't have OPENAI_API_KEY
set, so injecting env_key = "OPENAI_API_KEY" blocks them at startup.

With env_key absent, api_key() returns Ok(None) and Codex falls through
to the existing CodexAuth (OAuth for subscription, ApiKey for PAYG) —
both modes authenticate correctly without startup errors.

headroom/cli/wrap.py

@@ -583,7 +583,6 @@ def _inject_codex_provider_config(port: int) -> None:
         "[model_providers.headroom]\n"
         'name = "OpenAI via Headroom proxy"\n'
         f'base_url = "http://127.0.0.1:{port}/v1"\n'
-        f'env_key = "OPENAI_API_KEY"\n'
         f"requires_openai_auth = true\n"
         f"supports_websockets = true\n"
         f"{_CODEX_END_MARKER}\n"

tests/test_cli/test_wrap_codex.py

@@ -316,6 +316,23 @@ class TestSubscriptionRouting:
         assert "openai_base_url" not in cleaned
         assert 'model = "gpt-4o"' in cleaned
 
+    def test_no_env_key_in_injected_provider(
+        self, monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+    ) -> None:
+        """env_key must be absent so Codex doesn't require OPENAI_API_KEY.
+
+        Codex treats env_key as a hard requirement — if the env var is missing
+        it throws "Missing environment variable" at startup.  Subscription
+        (ChatGPT Plus) users don't have OPENAI_API_KEY set, so injecting
+        env_key breaks them (issue #393).
+        """
+        _set_test_home(monkeypatch, tmp_path)
+
+        wrap_mod._inject_codex_provider_config(8787)
+
+        content = (tmp_path / ".codex" / "config.toml").read_text()
+        assert "env_key" not in content
+
 
 # ---------------------------------------------------------------------------
 # Integration tests: full `headroom wrap codex` / `headroom unwrap codex`