chore(headless): bump the pinned Codex CLI to 0.146.0

[Astro-Han]

Summary

The synchronized three-arm benchmark pins Claude Code at 2.1.220 — the version its vendor ships today — and Codex at 0.144.6, published 2026-07-18. By the time #1983 merged on 2026-08-03, 0.145.0 (07-21) and 0.146.0 (07-29) had both shipped. The pin was chosen in mid-July and never refreshed before merge.

Pinning is correct; the fingerprint is what makes a published run reproducible. The defect is that the two pins were taken at different times, so the version skew is a property of the comparison rather than of either agent. A reader of the report cannot tell whether a Codex result reflects Codex or reflects a 17-day-old build, and the arm that loses the coin flip is the competitor's.

Repin Codex to 0.146.0. engines.node is unchanged at >=16, so the pinned Node 22.23.1 runtime and every archivePath / stripComponents entry stay as they are; only the version, URL, archive integrity, and the six vendored digests move.

The composition fingerprint carries the competitor version string, so the Terminal-Bench Codex and DeepSWE Codex manifest fingerprints move with the pin while Terminal-Bench Kimi Code, Terminal-Bench OpenCode, and DeepSWE Kimi Code stay byte-identical. That split is the assertion in harness composition preserves historical manifest fingerprints — if a non-Codex fingerprint had moved, this bump would have leaked outside its blast radius.

Refs #1970.

Verification

• npm run test -w @maka/headless — 1337 pass / 0 fail / 1 skip.
• npm run lint, npm run format:check, git diff --check — clean.
• archiveIntegrity cross-checked against the registry's own dist.integrity for 0.146.0-linux-x64; the same method reproduces the outgoing 0.144.6 value byte-for-byte from the registry, so the procedure is validated against a known-good pin rather than trusted blind.
• End-to-end prepareCodexToolchain() against the live registry: downloaded the archive, verified all six vendored digests plus the pinned Node runtime, and materialized a toolchain whose codex-package.json reports 0.146.0.

Rollout

Any in-flight run whose manifest froze the 0.144.6 composition fingerprint cannot resume across this change — that is the fingerprint doing its job. The full 89-task three-arm run for #1970 has not started; it will be launched on a fresh run id after this merges.