feat(registry): remote-refresh Codex client model catalog (#4276)

Load codex_client_models.json like models.json with validation, revisioned
handler reloads, CI bake, and Home-aware updater gates so list IDs still
come from Home while templates can refresh on the edge.

.github/scripts/refresh-model-catalogs.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+models_repository="${MODELS_REPOSITORY_URL:-https://github.com/router-for-me/models.git}"
+models_ref="${MODELS_REPOSITORY_REF:-main}"
+catalog_dir="${MODEL_CATALOG_DIR:-internal/registry/models}"
+codex_catalog="$catalog_dir/codex_client_models.json"
+codex_candidate="$(mktemp)"
+trap 'rm -f "$codex_candidate"' EXIT
+
+git fetch --depth 1 "$models_repository" "$models_ref"
+git show FETCH_HEAD:models.json > "$catalog_dir/models.json"
+
+if git show FETCH_HEAD:codex_client_models.json > "$codex_candidate" &&
+  go run ./cmd/validate_codex_models --file "$codex_candidate"; then
+	mv "$codex_candidate" "$codex_catalog"
+	printf 'Refreshed validated Codex client model catalog.\n'
+else
+	printf '::warning::Remote Codex client model catalog is missing or invalid; using embedded fallback.\n'
+fi
+
+go run ./cmd/validate_codex_models --file "$codex_catalog"