Fix: Install the whole Codex package so codex-code-mode-host sits beside bin/codex

Codex 0.165.0 ships as a package tree and runs bin/codex-code-mode-host,
codex-path/ and codex-resources/ relative to itself. The installer verified
the full archive but kept only bin/codex, so code mode failed. Keep the whole
verified tree, link ~/.local/bin/codex to its bin/codex, and replace the
receipted flat install earlier runs left behind once the new tree verifies.

setup/provenance/README.md

@@ -77,7 +77,10 @@ matched the `digest` GitHub publishes for that release asset. The installer
 accepts a Codex archive only when `tar -tzf` prints exactly the entries in
 `codex-package.listing`. Both architectures share that listing. 0.165.0 dropped
 the bundled `codex-resources/zsh/` and added `codex-resources/voice/`, and the
-archives grew past 128 MiB, so `CODEX_*_MAX_BYTES` is 256 MiB. To bump Codex,
+archives grew past 128 MiB, so `CODEX_*_MAX_BYTES` is 256 MiB. The installer keeps the
+whole verified tree as the version directory and links `~/.local/bin/codex` to
+its `bin/codex`, because Codex runs `bin/codex-code-mode-host` and reads
+`codex-path/` and `codex-resources/` relative to itself. To bump Codex,
 update `installers.conf`, regenerate the listing with `tar -tzf ARTIFACT`, and
 run `tests/setup/package-provenance-contract`.