Rebuild image when wrapper VERSION changes

[laurenceputra]

Summary

• Rebuild logic now tracks codex_yolo wrapper version from VERSION and forces image rebuild when that value changes.
• Docker image now stores wrapper metadata at /opt/codex-yolo-version so stale images are detected.
• Legacy images that do not contain wrapper metadata now trigger a one-time rebuild.
• Diagnostics now report wrapper version metadata in the image and whether it matches local wrapper version.
• Integration tests now assert wrapper metadata embedding and rebuild mismatch logic presence.

Problem

Previously, image rebuild decisions only considered image presence, explicit rebuild flags, and Codex CLI version mismatch. If wrapper scripts changed (including VERSION updates) but Codex CLI version stayed the same, old images could persist old runtime behavior.

Solution

• Added ARG CODEX_YOLO_WRAPPER_VERSION in .codex_yolo.Dockerfile and persisted it to /opt/codex-yolo-version.
• Added WRAPPER_VERSION detection in .codex_yolo.sh from ${SCRIPT_DIR}/VERSION.
• Passed wrapper version as a Docker build arg on every build.
• Read /opt/codex-yolo-version from existing image and computed wrapper_version_mismatch.
• Included wrapper_version_mismatch in need_build decision.
• Added clear logging when rebuild is due to wrapper version mismatch or missing legacy metadata.

Validation

• bash -n .codex_yolo.sh .codex_yolo_entrypoint.sh .codex_yolo_diagnostics.sh install.sh tests/integration_tests.sh
• ./tests/integration_tests.sh

Notes

• This change intentionally triggers rebuild even when CODEX_SKIP_VERSION_CHECK=1, because wrapper version mismatch is independent of Codex CLI npm version checks.