Fix: Install the whole Codex package so codex-code-mode-host sits beside bin/codex

Codex 0.165.0 ships as a package tree and runs bin/codex-code-mode-host,
codex-path/ and codex-resources/ relative to itself. The installer verified
the full archive but kept only bin/codex, so code mode failed. Keep the whole
verified tree, link ~/.local/bin/codex to its bin/codex, and replace the
receipted flat install earlier runs left behind once the new tree verifies.

tests/setup/package-provenance-contract

@@ -1375,8 +1375,11 @@ grep -qFx 'nvm:alias default 24.20.0' "$test_tmp/cases/node-x86_64/commands.log"
 [[ "$($test_tmp/cases/codex-x86_64/home/.local/bin/codex --version)" == \
     'codex-cli 0.165.0' ]] || fail 'x86_64 Codex activation has the wrong version'
 [[ "$(readlink "$test_tmp/cases/codex-x86_64/home/.local/bin/codex")" == \
-    "$test_tmp/cases/codex-x86_64/home/.local/lib/panama/codex/0.165.0/codex" ]] \
+    "$test_tmp/cases/codex-x86_64/home/.local/lib/panama/codex/0.165.0/bin/codex" ]] \
     || fail 'Codex did not atomically activate the reviewed version path'
+[[ -x "$test_tmp/cases/codex-x86_64/home/.local/lib/panama/codex/0.165.0/bin/codex-code-mode-host" \
+    && -f "$test_tmp/cases/codex-x86_64/home/.local/lib/panama/codex/0.165.0/codex-package.json" ]] \
+    || fail 'Codex dropped the helpers its package ships beside bin/codex'
 
 # Unsupported CPUs stop before curl. RustDesk's reviewed RPM is x86_64-only,
 # so aarch64 is also an intentional, recorded soft failure without a download.
@@ -1511,7 +1514,7 @@ done
 # Successful updates keep the old version directory and switch only the active
 # symlink after the replacement binary has passed its version check.
 for component_spec in 'Bun install_bun .bun/bin/bun .bun/versions/1.4.0/bin/bun' \
-    'Codex install_codex .local/bin/codex .local/lib/panama/codex/0.165.0/codex'; do
+    'Codex install_codex .local/bin/codex .local/lib/panama/codex/0.165.0/bin/codex'; do
     read -r component function_name active_relative target_relative <<<"$component_spec"
     name="${component,,}-atomic-update"
     reset_installer_fixture
@@ -1528,12 +1531,34 @@ for component_spec in 'Bun install_bun .bun/bin/bun .bun/versions/1.4.0/bin/bun'
     fi
 done
 
+# Installs before the package-layout fix kept only a receipted flat
+# 0.165.0/codex. That directory is ours, so the full tree replaces it.
+name=codex-flat-repair
+reset_installer_fixture
+STUB_SEED_OLD=Codex expect_success run_installer_function "$name" install_codex
+home="$test_tmp/cases/$name/home"
+flat="$home/.local/lib/panama/codex/0.165.0"
+rm -rf -- "$flat"
+mkdir -p -- "$flat"
+cp "$artifact_root/codex-x86_64.bin" "$flat/codex"
+chmod +x "$flat/codex"
+printf 'schema=1\nartifact_sha256=%s\nbinary_sha256=%s\n' \
+    e97c4463d7f146692a955d7b0e1c8cf48f97cd4d616cd45c5dcab2e8d9743316 \
+    c06a67fd8ac76508dc78bd99ce20c9f317b8d568beda59485f3f4134df9962d5 > "$flat/.panama-provenance"
+ln -sfn "$flat/codex" "$home/.local/bin/codex"
+STUB_REUSE_CASE=1 expect_success run_installer_function "$name" install_codex
+[[ "$(readlink "$home/.local/bin/codex")" == "$flat/bin/codex" \
+    && -x "$flat/bin/codex-code-mode-host" && ! -e "$flat/codex" ]] \
+    || fail "$name did not replace the flat install with the package tree"
+[[ ! -s "$test_tmp/cases/$name/softly-failed" ]] || fail "$name recorded a soft failure"
+assert_no_runtime_staging "$name"
+
 # Receipt or executable tampering preserves the directory and leaves an older
 # active link unchanged. A matching version string is not an attestation.
 for tamper_spec in \
     'Node install_node .nvm/versions/node/v24.20.0 bin/node v24.20.0' \
     'Bun install_bun .bun/versions/1.4.0 bin/bun 1.4.0' \
-    'Codex install_codex .local/lib/panama/codex/0.165.0 codex codex-cli_0.165.0'; do
+    'Codex install_codex .local/lib/panama/codex/0.165.0 bin/codex codex-cli_0.165.0'; do
     read -r component function_name target_relative binary_relative version_text <<<"$tamper_spec"
     for tamper_kind in receipt binary; do
         name="${component,,}-$tamper_kind-tamper"