fix(codex-implementer): make the timeout wrapper work under zsh

[wooter]

The bug

agents/codex-implementer.md tells the lane to invoke codex as:

T=$(command -v gtimeout || command -v timeout || true)
${T:+$T 600} codex exec \

${T:+$T 600} depends on bash word-splitting an unquoted parameter expansion. zsh doesn't do that by default, so "$T 600" arrives at execve as one argv word and the run dies immediately:

no such file or directory: /opt/homebrew/bin/gtimeout 600

Claude Code's Bash tool runs zsh on macOS, which is where this lane predominantly runs — so on those machines the timeout wrapper fails every single invocation. I logged this from eight separate sessions (across Sonnet and Fable lanes) before tracing it to this one line; each time the lane worked around it ad hoc, which is exactly the kind of drift the flag-discipline section exists to prevent.

The fix

Build the prefix as positional parameters:

if [ -n "$T" ]; then set -- "$T" 600; else set --; fi

"$@" codex exec \

"$@" expands to zero words when no positional parameters are set — in bash and zsh — so the uncapped fallback needs no special-casing and the wrapped path gets two clean argv words.

Secondary hardening: probe by running each candidate instead of trusting command -v. A command -v hit isn't proof the binary executes — a stale shell hash cache or a symlink left dangling by a relinked coreutils both yield exec failures, and I saw both reported against this preflight.

Verification

Shell	Result
bash	picks gtimeout, runs the wrapped command
zsh	picks gtimeout, runs the wrapped command
sh	picks gtimeout, runs the wrapped command
zsh, no timeout binary on PATH	warns once, runs uncapped

Docs-only change, scoped to the one code block and its row in the flag-discipline table. No behavioural change on bash.