Restore hermetic app-server integration keyring

[cbusillo]

Summary

• restore the persisted debug-only test keyring lost during upstream convergence
• route standalone and codex app-server integration launches through one fail-closed keyring setup path
• keep parent/child test processes on the same isolated store while preventing external test helpers from leaking shared temp roots
• add atomic cross-process, permission, startup, cleanup, and CLI-path regression coverage

Validation

• cargo fmt --all -- --check
• cargo test -p codex-app-server --test all suite::keyring_store:: -- --nocapture
• cargo test -p codex-cli --test app_server -- --nocapture
• focused strict-config, JSON logging, WebSocket transport, and plugin-startup app-server tests
• cargo check -p app_test_support -p codex-app-server -p codex-cli --tests --release
• breaking/context/testing/change-size review lenses: clean

Scope

This restores the previously merged PR #351 acceptance behavior on the current #465 candidate. The implementation plus its spawn wiring and cross-process proof are one coherent debug-only acceptance patch; splitting would leave either unused infrastructure or an unprotected test path.

Closes the remaining test-isolation acceptance gap in #306.