feat(baoyu-image-gen): add codex-cli provider wrapping codex-imagegen

Expose Codex CLI's built-in image_gen tool through baoyu-image-gen's
standard CLI + batch flow as a dedicated provider. The provider spawns
the bundled scripts/codex-imagegen/main.ts (synced from
packages/baoyu-codex-imagegen/src/) so the skill remains self-contained
and inherits retry, cache, file-lock, and JSONL logging. No
OPENAI_API_KEY required — uses the user's Codex subscription.

New env vars: BAOYU_CODEX_IMAGEGEN_{BIN,CACHE_DIR,TIMEOUT_MS,RETRIES,LOG_FILE}.
Hyphenated provider names now resolve under-scored env vars (e.g.,
BAOYU_IMAGE_GEN_CODEX_CLI_CONCURRENCY). codex-cli is never auto-selected
— pin via --provider or default_provider in EXTEND.md.

skills/baoyu-image-gen/references/codex-image2-fallback.md

@@ -19,7 +19,7 @@ This is expected. The `openai` provider uses the public OpenAI Images API and ne
 2. If it fails only because `OPENAI_API_KEY` is missing, do not leave the user waiting.
 3. Prefer a Codex/native raster backend in this order:
    - Codex runtime native `imagegen` skill/tool, if available.
-   - Repo-level `scripts/codex-imagegen.sh`, if `codex` CLI is installed/logged in and the calling skill supports the wrapper.
+   - `baoyu-image-gen --provider codex-cli` (preferred — wraps the bundled `scripts/codex-imagegen/main.ts`; the underlying repo-level package lives at `packages/baoyu-codex-imagegen/src/main.ts` for standalone callers), if `codex` CLI is installed/logged in.
    - Hermes native `image_generate`, if available.
 4. Be transparent about reference-image behavior:
    - If the fallback backend accepts references, pass the reference images.