This captures the pending musafety workflow hardening: Codex session commits now require agent/* branches by default, startup sandbox scripts gained stronger argument handling, and status self-update prompts default to no. The change also updates docs/templates/tests and publishes the next package version.

Constraint: Protected branches must stay safe for interactive maintainers while still supporting sandboxed agent automation

Rejected: Keep Codex non-agent commits allowed by default | too easy to accidentally write from protected/non-isolated branches

Confidence: high

Scope-risk: moderate

Reversibility: clean

Directive: If relaxing branch guards, update both hook templates and install tests in the same change

Tested: npm test (41/41 pass)

Not-tested: end-to-end npm publish in CI for this exact commit