Add OpenAI Secure MCP Tunnel share provider

[yyjeqhc]

Summary

Add an explicit webcodex share --tunnel openai provider for OpenAI Secure MCP Tunnel while keeping Cloudflare Quick Tunnel as the default first-run path.

• pin and verify OpenAI tunnel-client v0.0.12 for supported Linux/macOS amd64/arm64 targets, with override/PATH reuse and managed download fallback
• run tunnel-client doctor, supervise the daemon, and gate readiness on its loopback /readyz
• keep the temporary WebCodex Bearer local via a private file-backed MCP Authorization header; ChatGPT uses Tunnel + No authentication
• remove broader OpenAI keys from the long-lived tunnel daemon environment and preserve only the Runtime API key authority
• isolate npm wrapper network variables from spawned Server/Runner/tunnel processes while reusing the existing bounded proxy/CA resolution for managed downloads
• update CLI/help/onboarding/MCP docs and fix the stale cloudflared onboarding guidance

Validation

• cargo fmt -- --check
• cargo check --all-targets
• cargo test --locked -p webcodex --lib — 2980 passed
• focused OpenAI tunnel tests — 6 passed
• share tests — 14 passed
• managed cloudflared tests — 11 passed
• startup dispatch test — passed
• Markdown local links — 263 checked, 0 missing
• test inventory self-test + inventory — passed
• macOS arm64 branch build on mini: webcodex-server + webcodex-runner passed

The mini host does not currently have CONTROL_PLANE_TUNNEL_ID / CONTROL_PLANE_API_KEY configured, so the final live control-plane Tunnel handshake is intentionally left for credentialed dogfood rather than fabricating credentials in CI.