Codex is wired up where codex is installed

Synced from the source repo. install.sh and install.ps1 now run
`standup install --runtime codex` machine-wide where codex is on PATH,
with --no-codex / -NoCodex to opt out, and name the per-project
AGENTS.md step in their closing lines.

Signed-off-by: disqualifier <dev@disqualifier.me>

install.ps1

@@ -243,6 +243,15 @@ if (-not $serviceOnly) {
   & standup install --runtime claude
   if ($LASTEXITCODE -ne 0) { Warn 'runtime install reported a problem; see doctor below' }
 
+  # Codex where its binary exists. Machine-wide: the skill and the hooks. The
+  # AGENTS.md step needs a project and is skipped here -- named in the closing
+  # lines instead. Not run at all without codex, so no marked blocks are left
+  # for a tool that is not installed; -NoCodex opts out where it is.
+  if (-not $NoCodex -and $codexBin) {
+    & standup install --runtime codex
+    if ($LASTEXITCODE -ne 0) { Warn 'codex runtime install reported a problem; see doctor below' }
+  }
+
   if ($probe -and -not $probe.HasExited) { Stop-Process -Id $probe.Id -Force -ErrorAction SilentlyContinue }
   Remove-Item -Recurse -Force $probeDir -ErrorAction SilentlyContinue
 }
@@ -300,13 +309,11 @@ Write-Host ''
 & standup code
 Write-Host ''
 Write-Host 'Next: cd <your project>; standup create'
-# Codex's runtime is per-project -- one of its three targets is the project's
-# own AGENTS.md -- so the installer cannot wire it from here: there is no
-# project yet, and the runtime step's throwaway is deleted. Name the command
-# instead, only where codex exists and the user has not opted out.
 if (-not $NoCodex -and $codexBin) {
   Write-Host ''
-  Write-Host 'Codex is installed here. In each project you want it in:'
+  Write-Host 'Codex: the skill and hooks are wired machine-wide. Codex must TRUST them:'
-  Write-Host '  standup install --runtime codex    # hooks, skill, a block in AGENTS.md'
+  Write-Host '  run /hooks inside Codex and approve.'
+  Write-Host 'Per project, for the room rules in AGENTS.md:'
+  Write-Host '  standup install --runtime codex'
 }
 }

install.sh

@@ -426,6 +426,13 @@ if [ "$SERVICE_ONLY" = 0 ]; then
     done
   fi
   standup install --runtime claude || warn "runtime install reported a problem; see doctor below"
+  # Codex where its binary exists. Machine-wide: the skill and the hooks. The
+  # AGENTS.md step needs a project and is skipped here -- named in the closing
+  # lines instead. Not run at all without codex, so no marked blocks are left
+  # for a tool that is not installed; --no-codex opts out where it is.
+  if [ "$NO_CODEX" = 0 ] && [ -n "$CODEX_BIN" ]; then
+    standup install --runtime codex || warn "codex runtime install reported a problem; see doctor below"
+  fi
   [ -n "$PROBE_PID" ] && { kill "$PROBE_PID" 2>/dev/null || true; wait "$PROBE_PID" 2>/dev/null || true; PROBE_PID=""; }
   rm -rf "$PROBE_DIR"; PROBE_DIR=""
 fi
@@ -471,9 +478,12 @@ if [ -n "$DAEMON_NODE" ]; then
     service_as_operator start >/dev/null 2>&1 \
       || warn "service installed but did not start; see 'standup service status'"
   elif printf '%s' "$SVC_OUT" | grep -qi 'connect to bus'; then
+    # By hand on the unit's home, `standup daemon` is operator-only once a
+    # code exists (P8-06), so the hint carries the flag (R213 C1).
     warn "no systemd --user bus here, so the unit was written but not enabled.
          If this is WSL2: add [boot] systemd=true to /etc/wsl.conf, then 'wsl --shutdown'.
-         Until then run 'standup daemon' yourself; single mode needs nothing."
+         Until then run 'standup daemon --code <operator code>' yourself ('standup code'
+         prints it); single mode needs nothing."
   else
     warn "service install failed; single mode still works. See 'standup service status'."
   fi
@@ -494,12 +504,10 @@ say ""
 standup code 2>/dev/null || say "  (run 'standup code' for the operator code)"
 say ""
 say "Next: cd <your project> && standup create"
-# Codex's runtime is per-project -- one of its three targets is the project's
-# own AGENTS.md -- so the installer cannot wire it from here: there is no
-# project yet, and step 7's throwaway is deleted. Name the command instead,
-# only where codex exists and the user has not opted out.
 if [ "$NO_CODEX" = 0 ] && [ -n "$CODEX_BIN" ]; then
   say ""
-  say "Codex is installed here. In each project you want it in:"
+  say "Codex: the skill and hooks are wired machine-wide. Codex must TRUST them:"
-  say "  standup install --runtime codex    # hooks, skill, a block in AGENTS.md"
+  say "  run /hooks inside Codex and approve."
+  say "Per project, for the room rules in AGENTS.md:"
+  say "  standup install --runtime codex"
 fi