[Bug]: codex_model root default enables Codex on every deployment

### Description

`codex_model` is declared in the root module with a non-empty default, so every environment that does not explicitly opt out enables Codex on its next apply. The sibling CLI model variables are opt-in. This appears unintentional.

`#350` added to `terraform/variables.tf`:

```hcl
variable "codex_model" {
description = "Default Codex-on-Bedrock model id ... (empty = none)"
type = string
default = "openai.gpt-5.5"
}
```

That value is passed into the AgentCore module at `terraform/main.tf:353`:

```hcl
codex_model = var.codex_model
```

The module's own variable defaults to empty and documents empty as meaning none (`terraform/modules/compute/agentcore/variables.tf:90`), and the module treats empty as not-enabled (`terraform/modules/compute/agentcore/main.tf:426`):

```hcl
var.codex_model != "" ? { codex = var.codex_model } : {}
```

Because the root default is non-empty, the module never receives the empty value its own default and description describe. The `cli-models` SSM parameter is seeded with a `codex` entry.

This is inconsistent with the other CLI models. `kiro_model` defaults to `""` in the module (`agentcore/variables.tf:84`) and is set explicitly at the call site. `bedrock_model` is set per environment in tfvars. `codex_model` is the only one that is on unless explicitly disabled.

Expected: enabling a new agent CLI is an explicit, per-environment decision.
Actual: it is inherited from a root default, and nothing in a `terraform plan` diff reads as "enabling a new agent CLI".

### Steps to reproduce

1. `git checkout main` at `b9ab0b6d`
2. Use an environment tfvars that does not set `codex_model` (for example one containing only `environment`, `aws_region`, `bedrock_model`)
3. `terraform plan -var-file=terraform/environments/.tfvars`
4. Inspect the planned value of the `cli-models` SSM parameter: it contains a `codex` entry despite `codex_model` never being set for that environment

### Logs or screenshots

Root default, `terraform/variables.tf`:

```hcl
variable "codex_model" {
default = "openai.gpt-5.5"
}
```

Module default and gate, `terraform/modules/compute/agentcore/`:

```hcl
# variables.tf:84
variable "kiro_model" { default = "" }
# variables.tf:90
variable "codex_model" { default = "" } # description says "(empty = none)"

# main.tf:422
var.kiro_model != "" ? { kiro = var.kiro_model } : {},
# main.tf:426
var.codex_model != "" ? { codex = var.codex_model } : {}
```

### Environment

- `main` at `b9ab0b6d` (#350)
- Terraform `>= 1.0` (`terraform/main.tf:2`); CI pins `1.15.0`
- Affects any environment whose tfvars omits `codex_model`

### Question

Is the non-empty root default intended?

If Codex should be opt-in like Kiro, the root default should be `""` and environments should opt in through tfvars. If it is intended to be on by default, then the module variable's `""` default and its `(empty = none)` description are misleading and should be updated to match.

### Related

`#350` also materializes `CODEX_HOME` under the persistent workspace mount (`lambda/agentcore/stage-materializer.js:400`; asserted as `/.aidlc/codex-home` in `lambda/agentcore/test/stage-materializer.test.js:610`). Anything on that mount is subject to the AgentCore session-storage idle expiry, documented as 14 days in `terraform/modules/compute/agentcore/main.tf:619`. That is the mount's expiry rather than a Codex-specific retention policy, but enabling Codex by default widens what lands there, which is a further reason to make the choice explicit.

Start with terraform/variables.tf and compare the root codex_model default with terraform/modules/compute/agentcore/variables.tf and main.tf. Run the documented terraform plan using an environment tfvars file that omits codex_model, then verify the cli-models SSM parameter has no codex entry by default; an explicit environment override should still enable it.

Written by the indexing model from the issue text.