Fix Updates

[kordless]

Fix it so when you update it stays put.

[kordless]

Proposal to stabilize updates:

• Treat MCP config and env files as workspace source of truth; on restart, sync from workspace to /opt but never the other way.
• Add a “post-update” hook that re-applies .codex-mcp.config and envs after image pulls/rebuilds so user configs persist.
• Bake a quick “doctor” command to report which tools are enabled/disabled and which env vars are missing.
• Document the expected persistence layer (workspace mounts) vs. ephemeral paths to avoid accidental loss during upgrades.

[kordless]

Since this was filed we added two pieces that address the “updates should stick” request:

1. scripts/codex_container.ps1 gained an Install mode + shim writer (see lines 1160-1230) so the launcher can be installed once on the host PATH, rather than re-copying manually after every update.
2. Ensure-CodexCli caches the npm install inside the Codex container for the lifetime of that container and honors -SkipUpdate to avoid re-running unless you explicitly force it.

If there’s another behavior you wanted (e.g., persisting CLI bits across different containers), let me know, but the core “update once and keep the launcher/CLI around” flow exists now.