shared-write: ~/.codex/config.toml has no isolation, one confirmed collision this session

Shared file: ~/.codex/config.toml. Writers: every -ca (Codex CLI) agent on venus — 10 live sessions currently, all launched via the same shared ~/.local/bin/ca.sh -> codex ... resume --last, no per-agent config path. No git tracking at all on ~/.codex (fatal: not a git repository) — zero diff/merge/history safety, worse than sh.git's checkout. Collision-prevention today: NONE — pure last-write-wins on a single 2KB file, no lock, no convention observed. COLLISION ALREADY HAPPENED, evidenced this session (2026-08-29/30): I edited the top-level model key to gpt-5.6-terra at 13:32 UTC 08-29 (backed up first to config.toml.bak-20260829-1032); later observed the same key silently changed to gpt-5.6-sol by another agent/process with no coordination, no DM, no note. Separately, same file was the site of an earlier same-day incident (coder-llmmsgsrv-ca misdiagnosis) where I nearly rewrote the shared model line fleet-wide chasing what turned out to be ordinary compaction, not a hang. FIX NOT TAKEN, flagging per instruction: options are per-profile blocks (config.toml already supports [profiles.<name>] + --profile, mechanism exists but unused), a wrapper that merges instead of overwrites, or per-agent config paths via CODEX_HOME.