Document Codex refresh_token_reused recovery when Hermes auth still works

## Problem
When Codex CLI reports `refresh_token_reused`, the current recovery guidance can send users straight to `codex login` even if Hermes' `openai-codex` provider still has fresh working tokens. That creates a split-brain auth situation: Hermes works, standalone `codex exec` fails.

## Expected behavior
The Codex skill should distinguish a Hermes provider outage from a stale standalone Codex CLI credential store, and suggest repairing the standalone auth file only after a Hermes smoke test proves the provider route still works.

## Current downstream workaround
A local downstream skill patch adds guidance to verify Hermes `openai-codex`, repair the standalone CLI credential store from Hermes tokens via a helper script, chmod the auth file, then re-test `codex exec`.

## Notes
This is documentation/runbook guidance only; it does not change Codex or Hermes auth behavior.