Decide whether -ca (Codex) agents should be wakeable

MEASURED 2026-08-22 on venus and lezama: agent-wake.sh:172 spawns only via 'ccs-tmux.sh --detach'; ca-tmux.sh has zero occurrences of detach (46 lines vs ccs-tmux.sh 143); agent-attach.sh:361-362 dispatches both kinds. So every -ca agent is attachable but unwakeable. Separately ca-tmux.sh has no picker poller, and bin-lezama-cc measured a Codex trust-folder gate sitting indefinitely with no timeout until keys were sent by hand - so a ca agent rooted outside a trusted tree wedges silently with nothing watching. Softening: Codex trust inherits from a parent [projects.*] entry, so agents under an already-trusted root boot clean; exposure is scratch launches and agents rooted outside known trees. OPTIONS: (A) add --detach AND a picker poller to ca-tmux.sh - without the poller, waking one just automates the wedge; (B) --detach only - wakeable but can still hang unwatched; (C) rule them deliberately not wakeable and land a comment in ca-tmux.sh saying so. PM recommends C unless Elazar actually wakes Codex agents. Awaiting his ruling; comment lands either way since the tmux wrappers are pm-llmmsgsrv-cc's lane.