fix(codex): clean broken config.toml before patching + fix macOS user discovery

- Delete config.toml with double-quoted keys bug before regenerating
- Replace pwd.getpwall() with /Users/* scan on macOS (Directory Services unreliable)
- Proper chown via stat of home directory

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

codex/ucodex_install.sh

@@ -178,6 +178,18 @@ info "Downloading patcher..."
 curl -fsSL -H "Authorization: token ${GITEA_TOKEN}" "$REPO_RAW/codex_patcher.py"  -o "$INSTALL_DIR/codex_patcher.py"
 curl -fsSL -H "Authorization: token ${GITEA_TOKEN}" "$REPO_RAW/codex_config.json" -o "$INSTALL_DIR/codex_config.json"
 
+# Remove broken config.toml from previous installs (double-quoted keys bug)
+info "Cleaning broken configs..."
+if $IS_MACOS; then
+    for cfg in /Users/*/.codex/config.toml /var/root/.codex/config.toml; do
+        [ -f "$cfg" ] && grep -q '""/' "$cfg" 2>/dev/null && rm -f "$cfg" && warn "Removed broken: $cfg"
+    done
+else
+    for cfg in /home/*/.codex/config.toml /root/.codex/config.toml; do
+        [ -f "$cfg" ] && grep -q '""/' "$cfg" 2>/dev/null && rm -f "$cfg" && warn "Removed broken: $cfg"
+    done
+fi
+
 info "Applying patches..."
 python3 "$INSTALL_DIR/codex_patcher.py" --apply --all --config "$INSTALL_DIR/codex_config.json"
 log "Patches applied"