fix(codex-runtime): re-running /codex-runtime codex_app_server when already enabled now triggers migration

The /codex-runtime slash command short-circuits with "openai_runtime
already set" when invoked with the same value as the current config,
and crucially skips the entire migration block below. The check
conflates two things: (a) "the config value is correct" and (b) "the
world state (managed block in ~/.codex/config.toml, hermes-tools MCP
callback, plugin discovery) is converged".

Common footgun this exposes: a user who pre-sets
`model.openai_runtime: codex_app_server` directly in config.yaml
(reasonable thing to do) and then runs /codex-runtime codex_app_server
to trigger migration sees "already set" and silently gets no migration.
~/.codex/config.toml never receives the managed block, the hermes-tools
MCP callback never registers, and codex falls through to its default
runtime instead of the app-server one — visibly successful but
functionally partial setup.

The migration is idempotent by design (it replaces its own managed
block in place between MIGRATION_MARKER and MIGRATION_END_MARKER), so
re-running it is safe and cheap. Fix the short-circuit to fall through
to migration when re-applying codex_app_server while skipping the
config persist (no value-level change needed). The disable case
(re-applying "auto") still short-circuits because disabling doesn't
touch ~/.codex/config.toml at all.

The user-visible message changes to "openai_runtime already set to
codex_app_server — re-applying migration" so re-runs surface what
happened.

Regression test (test_reapply_codex_app_server_runs_migration) asserts:
- migrate() was called when re-applying
- persist_callback was NOT called (no config write on no-op transitions)
- migration output (MCP servers, sandbox default) surfaces in the
  user-visible message
- requires_new_session is True so callers know to /reset

Verified RED→GREEN: the test fails on origin/main with
"migration must run on reapply, not just first enable" and passes with
this fix. Full test_codex_runtime_switch.py suite: 31 passed.

tests/hermes_cli/test_codex_runtime_switch.py

@@ -96,6 +96,56 @@ class TestApply:
         assert r.success
         assert r.message == "openai_runtime already set to auto"
 
+    def test_reapply_codex_app_server_runs_migration(self):
+        """Re-applying codex_app_server when already enabled must still
+        run the migration. Common footgun: user pre-sets
+        `openai_runtime: codex_app_server` in config.yaml, then runs
+        /codex-runtime codex_app_server expecting the migration. Without
+        this, the slash command short-circuits with "already set" and
+        ~/.codex/config.toml never gets the hermes-tools MCP callback
+        or plugin migration — silent partial setup.
+        """
+        cfg = {
+            "model": {"openai_runtime": "codex_app_server"},
+            "mcp_servers": {
+                "filesystem": {"command": "npx", "args": ["-y", "fs-server"]},
+            },
+        }
+        persisted = {}
+
+        def persist(c):
+            persisted.update(c)
+
+        with patch.object(crs, "check_codex_binary_ok",
+                          return_value=(True, "0.130.0")), \
+             patch("hermes_cli.codex_runtime_plugin_migration.migrate") as mig:
+            mig.return_value.migrated = ["filesystem", "hermes-tools"]
+            mig.return_value.migrated_plugins = []
+            mig.return_value.plugin_query_error = None
+            mig.return_value.wrote_permissions_default = ":workspace"
+            mig.return_value.errors = []
+            mig.return_value.target_path = "/fake/.codex/config.toml"
+            r = crs.apply(cfg, "codex_app_server",
+                          persist_callback=persist)
+        assert r.success
+        assert mig.called, "migration must run on reapply, not just first enable"
+        # Re-apply should signal "already set" but still announce migration ran
+        assert "already set" in r.message
+        assert "re-applying migration" in r.message
+        # Migration output still surfaces
+        assert "Migrated 1 MCP server" in r.message
+        assert "filesystem" in r.message
+        assert "Default sandbox: :workspace" in r.message
+        # No config write needed when value is unchanged — the persist
+        # callback should NOT have fired (avoids spurious config.yaml mtimes
+        # on every re-apply).
+        assert persisted == {}, (
+            "persist_callback fired despite no config-value change"
+        )
+        # Caller still needs a fresh session for the cached agent to pick
+        # up any migration-driven changes.
+        assert r.requires_new_session is True
+
     def test_enable_blocked_when_codex_missing(self):
         cfg = {}
         with patch.object(crs, "check_codex_binary_ok",