Pass prompt via stdin in /codex skill to fix Windows argv limit (also closes #971, #1034)

## Summary

The `/codex` skill in `codex/SKILL.md` invokes `codex exec` with the prompt as a positional argv argument in both **Challenge mode (Step 2B)** and **Consult mode (Step 2C)**. When the constructed prompt exceeds roughly 32KB - which happens easily in Consult mode because Step 2C *prepends the entire plan-file content* to the prompt, and in Challenge mode when Claude packs a large git diff into the prompt - the invocation fails on Windows before the Codex binary ever starts.

Observed failure on `gstack` v0.16+ / `codex-cli` 0.128.0 / Windows 10 / Git Bash (msys2) / Node v22.22.1, with a ~57KB prompt:

```
/c/Users//AppData/Roaming/npm/codex: line 15: /c/Program Files/nodejs/node: Argument list too long
/c/Users//AppData/Roaming/npm/codex: line 15: /c/Program Files/nodejs/node: No error
```

Root cause is the Win32 `CreateProcess` ~32,767-character command-line limit (KB830473). The npm-installed `codex` shim launches `node` via Git Bash / cmd.exe and inherits that limit, so any argv larger than ~32KB never reaches the Codex Rust binary. The skill silently breaks for Windows users above that threshold, with a cryptic error from the npm shim that doesn't mention gstack, Codex, or the skill at all.

## Why this is worth fixing now (and why it's not a duplicate)

This is closely related to two existing issues that complain about the same `codex exec ""` pattern in skill bash blocks, from different angles:

- #971 --- `codex exec` hangs in skill bash blocks because stdin isn't closed (missing `40KB):

1. Have `~/.claude/plans/-*.md` exist with a long plan (40-80KB is enough).
2. In a Claude Code session inside the project, run `/codex` with no arguments.
3. The skill auto-detects Consult mode and prepends the plan content to the prompt (Step 2C).
4. When the assembled prompt exceeds ~32KB, the Bash invocation fails:

```
Bash(... PROMPT=$(cat /tmp/codex/prompt.txt); codex exec "$PROMPT" -C "$_REPO" -s read-only ...)
⤷ ---STDERR---
/c/Users//AppData/Roaming/npm/codex: line 15: /c/Program Files/nodejs/node: Argument list too long
/c/Users//AppData/Roaming/npm/codex: line 15: /c/Program Files/nodejs/node: No error
```

A minimal manual repro (no skill involved):

```bash
python -c "print('x' * 50000)" > /tmp/prompt.txt
PROMPT="$(cat /tmp/prompt.txt)"
codex exec "$PROMPT" -s read-only # fails with Argument list too long on Windows
codex exec - -s read-only < /tmp/prompt.txt # works on Windows
```

## Proposed fix

In `codex/SKILL.md`, switch both `codex exec` invocations from argv to stdin:

**Step 2B (Challenge mode) - current:**

```bash
codex exec "" -s read-only -c 'model_reasoning_effort="xhigh"' --enable web_search_cached --json 2>/dev/null | python3 -c "..."
```

**Step 2B - proposed:**

```bash
printf '%s' "" \
| codex exec - -s read-only -c 'model_reasoning_effort="xhigh"' --enable web_search_cached --json 2>/dev/null \
| python3 -c "..."
```

**Step 2C (Consult mode) - same transformation**, both for the new-session and resumed-session forms. The `<<< ""` here-string is an alternative but is bash-specific; `printf '%s' "$PROMPT" | codex exec -` works in any POSIX shell.

This change:

1. Sidesteps the Win32 `CreateProcess` argv limit entirely - stdin has no such ceiling on any platform.
2. Naturally closes stdin (pipe reaches EOF after the prompt streams in), which also resolves #971 and #1034 without needing `