feat: adopt codex batch tool (safe code-mode core)

[Patel230]

Summary

Follow-up to the codex adoption audit (#224). Implements the safe, high-value core of codex's Code Mode without an embedded script runtime:

• Batch tool: runs a list of read-only tool calls in a single turn, cutting agent round-trips for fan-out research.
• Security by construction: only read-only tools (reuses tool.IsReadOnly) are accepted; every inner call resolves through the session registry, schema-validates, and executes individually. No mutation can bypass the normal tool pipeline.
• Registered in the optional (lazy) tool set so it is promoted on demand.
• Updated docs/plans/codex-adoption-plan.md: marks Batch as the adopted safe core of Code Mode; keeps full arbitrary-script Code Mode, agent-identity signing, and cloud-tasks as explicitly deferred RFCs (already covered by internal/identity + HMAC-chained internal/securitylog / Hawk Cloud respectively).

Test plan

• New unit tests: read-only execution, non-read-only rejection, empty/unknown rejection
• Full go test ./... green (twice — locally and via pre-push hook)
• make vet, make lint, hawk verify green
• Boundary guards, submodule drift, govulncheck passed in pre-push hooks
• markdownlint-cli2 clean on updated doc