HEY skill should retry outside the Codex sandbox when Keychain auth is unavailable

On macOS, the HEY skill in Codex can report that `hey` is not authenticated even though `hey auth status` succeeds in the user's terminal.

The Codex process may be sandboxed and unable to access credentials stored in the macOS Keychain. In that case, `hey auth status --json` and other HEY commands return `authenticated: false` or a `Not logged in` error. Running the same command with elevated sandbox permissions succeeds using the existing credentials.

`HEY_NONINTERACTIVE=1` does not resolve the problem because it only prevents an interactive login prompt. The current skill tells the agent to report the task as blocked and ask the user to run `hey auth login`, even though the user is already logged in.

The skill should tell Codex agents on macOS to retry the HEY command with elevated sandbox permissions when Keychain access may be blocked. It should only ask the user to log in if that retry also returns an authentication error.

This happened with `hey` 1.4.0. I also checked the skill on `main` and in the latest 1.4.3 release, and the current authentication instructions do not cover this case.

Start at the HEY skill's authentication instructions and trace how failed `hey auth status --json` or other HEY commands are handled on macOS. Update the guidance so a sandbox-permission retry happens before asking the user to log in, and verify that login is requested only after the retry still reports an authentication error.

Written by the indexing model from the issue text.