[DanielNetzer]

Implements issue #392.

Molecule: mol-392-b4de6876d723f58fdc1818e2
Formula: forgecell-github-issue
Base: 244247a3728c8fc95e2ed2a79e9189d0f0a1be12
Delivery: c890da31aef7c808f747790c3c5a869d92a5075b

Awaiting exact-commit CI and human review. Harness-reported checks are not independent CI evidence. No merge, deployment or issue closure is authorized.

[DanielNetzer]

Review notes (LOW, not blocking):

• codexConfigDigest now reads the whole config.toml into memory (within the existing 1 GB bound) instead of streaming it into the hash. Real files are a few KB.
• Comments and blank lines inside a dropped table are dropped with it; comments elsewhere still count. That's intended: a comment edit outside the dropped tables still needs a fresh approval.
• Upgrading changes every existing Codex binding's fingerprint once, as the code comment says, so Codex plans approved before the upgrade need a fresh intake. Goes in the v0.4.5 notes.

All checks passed; no protected failures.