[BUG] global audit scans unmanaged Codex session history for hidden Unicode

Describe the bug

APM 0.31.0's global audit scans Codex session history under ~/.codex/sessions/ as deployed content. A literal U+202E RIGHT-TO-LEFT OVERRIDE in an unmanaged session file causes apm audit --ci to fail its content-integrity check and recommend apm audit --strip.

This reproduces with an empty global dependency list. APM did not install or record ownership of the session file.

To Reproduce

1. In an isolated test home, create ~/.apm/apm.yml:

   name: global-profile
   version: 1.0.0
   targets: [codex]
   dependencies:
     apm: []
     mcp: []
   

2. Create ~/.codex/sessions/unmanaged.jsonl with a JSON string containing a literal U+202E character. For example, this Python expression produces the file contents (the character must be literal, not a JSON escape):

   json.dumps({"message": "safe" + chr(0x202E) + "reversed"}, ensure_ascii=False) + "\n"
   

3. Run apm lock -g, then run apm audit --ci --no-policy --no-drift from ~/.apm in that same test home.

4. Observe exit code 1 and the content-integrity finding below.

Expected behavior

Audit excludes unrelated Codex application state such as session history. Hidden-Unicode scanning should still cover deployable primitive locations, including unrecorded files in those locations, and explicit deployment claims.

Environment (please complete the following information):

• OS: macOS
• Python Version: 3.14.7
• APM Version: 0.31.0 (Homebrew); also reproduced with current main

Logs

content-integrity: 1 file(s) with critical hidden Unicode
-- run 'apm audit --strip' to clean Unicode

content-integrity details:
  - unicode: .codex/sessions/unmanaged.jsonl

[x] 1 of 8 check(s) failed

Additional context

The Codex target declares .codex as its root. install_governance includes the whole root prefix, and the audit scanner recursively scans that prefix. This brings session history into the scan despite it being outside the target's primitive locations.

Start with the Codex target declaration in src/apm_cli/integration/targets.py, then trace install_governance in src/apm_cli/install/manifest_reconcile.py and the recursive audit logic in src/apm_cli/security/file_scanner.py. Reproduce the issue with the isolated ~/.codex/sessions/unmanaged.jsonl file and the stated audit command. Done means unrelated session history is excluded while deployable primitive locations and explicit deployment claims remain covered.