chore(go): audit providers claudecode codex cursor gemini

Add managed_runtime.go (paths, config validation, identity, runtime file
changes, status checks) and shell_command.go (quoting, PowerShell
encoding, command parsing) and move the four providers onto them.

Claude-Session: https://claude.ai/code/session_01Agoc9bRVE9KL7mmWtey9Vq

cmd/elydora/plugins/codex_contract.go

@@ -6,9 +6,7 @@ import (
 	"fmt"
 	"path/filepath"
 	"reflect"
-	"runtime"
 	"sort"
-	"strings"
 )
 
 const (
@@ -20,7 +18,6 @@ const (
 	codexOwnedDescription   = "Elydora audit and freeze enforcement"
 	codexGuardStatusMessage = "Checking Elydora agent state"
 	codexAuditStatusMessage = "Recording Elydora tool use"
-	codexPOSIXApostrophe    = `'"'"'`
 )
 
 type codexHooks map[string][]map[string]any
@@ -40,11 +37,7 @@ type codexRenderedDocument struct {
 	remove   bool
 }
 
-type codexRuntimeContract struct {
-	agentID   string
-	guardPath string
-	auditPath string
-}
+type codexRuntimeContract = managedRuntimeContract
 
 func cloneCodexObject(value map[string]any) map[string]any {
 	clone := make(map[string]any, len(value))
@@ -62,28 +55,6 @@ func cloneCodexHooks(source codexHooks) codexHooks {
 	return clone
 }
 
-func sameCodexPath(left, right string) bool {
-	left = filepath.Clean(left)
-	right = filepath.Clean(right)
-	if absolute, err := filepath.Abs(left); err == nil {
-		left = absolute
-	}
-	if absolute, err := filepath.Abs(right); err == nil {
-		right = absolute
-	}
-	if runtime.GOOS == "windows" {
-		return strings.EqualFold(left, right)
-	}
-	return left == right
-}
-
-func sameCodexAgentID(left, right string) bool {
-	if runtime.GOOS == "windows" {
-		return strings.EqualFold(left, right)
-	}
-	return left == right
-}
-
 func readCodexHooks(value any, label string) (codexHooks, error) {
 	object, ok := value.(map[string]any)
 	if !ok {
@@ -126,16 +97,6 @@ func readCodexHooks(value any, label string) (codexHooks, error) {
 	return hooks, nil
 }
 
-func decodeStrictJSONObject(source []byte, label string) (map[string]any, error) {
-	if !json.Valid(source) {
-		var value any
-		if err := json.Unmarshal(source, &value); err != nil {
-			return nil, fmt.Errorf("parse %s: %w", label, err)
-		}
-	}
-	return decodeJSONCObject(source, label, false)
-}
-
 func parseCodexDocument(filePath string, raw []byte) (*codexDocument, error) {
 	label := fmt.Sprintf("Codex user hooks at %s", filePath)
 	root, err := decodeStrictJSONObject(raw, label)
@@ -180,7 +141,7 @@ func removeCodexGroups(
 		for _, value := range handlers {
 			handler := value.(map[string]any)
 			managedID, managed := codexManagedAgentID(handler, scriptName, status)
-			if managed && (agentID == "" || sameCodexAgentID(managedID, agentID)) {
+			if managed && (agentID == "" || sameManagedAgentID(managedID, agentID)) {
 				continue
 			}
 			kept = append(kept, handler)
@@ -295,11 +256,7 @@ func managedCodexIDs(
 			if !managed {
 				continue
 			}
-			key := agentID
-			if runtime.GOOS == "windows" {
-				key = strings.ToLower(agentID)
-			}
-			result[key] = agentID
+			result[managedReferenceKey(agentID)] = agentID
 		}
 	}
 	return result