Agents plugin cannot read Codex limits with Codex CLI 0.149.0 because -a untrusted is invalid #7873

codex -s read-only -a untrusted app-server

Codex CLI 0.149.0 no longer accepts untrusted as an approval policy. Running that command directly produces:

error: invalid value 'untrusted' for '--ask-for-approval <APPROVAL_POLICY>'
  [possible values: on-request, never]

Because the app server exits before responding to the initialization RPC, omarchy-agent-usage-codex returns:

{
  "tierLabel": "",
  "limits": [],
  "usageStatusText": "Codex limits unavailable",
  "authHelpText": "initialize"
}

The relevant command is currently constructed in:

/usr/share/omarchy/bin/omarchy-agent-usage-codex

It appears that the collector needs to replace -a untrusted with a currently supported value, likely -a never, given that it starts the app server in a read-only sandbox solely to query account information.

## Steps to reproduce

1. Install Omarchy 4.0.0-1 and Codex CLI 0.149.0.
2. Authenticate Codex using codex login.
3. Use Codex so that it appears in the Omarchy Agents plugin.
4. Open the Agents panel or refresh its data.
5. Observe “Codex Limits Unavailable” with “initialize” beneath it.

The issue can also be reproduced directly with:

omarchy-agent-usage-codex --limits-only |
  jq '{tierLabel, limits, usageStatusText, authHelpText}'

Result:

{
  "tierLabel": "",
  "limits": [],
  "usageStatusText": "Codex limits unavailable",
  "authHelpText": "initialize"
}

## Expected behaviour

The collector should start the Codex app server successfully, query account/rateLimits/read, and display the available Codex limit windows and reset times.

If app-server startup fails, it would also be helpful for the panel to display the underlying stderr message instead of only the RPC stage name initialize.