Follow-up to the previous fix: the stdin branch dropped "$@", so
options like -s read-only silently never reached codex. Stub now
records argv and tests assert flags + stdin prompt arrive together;
verified live (-s read-only => codex reports READONLY).
Options like -s read-only routed execution into the /dev/null branch,
so codex got no prompt at all. codex natively appends piped stdin as
a <stdin> block, so feeding prompt.md unconditionally is safe.