tools-sync: MCP 审计改用 codex mcp list --json 作为 Codex 侧权威口径

Codex 26.825 起不再把用户 MCP 注册写入 ~/.codex/config.toml，导致原来解析
config.toml 的审计每次都把 7 个已注册 MCP 误报成 "Claude only" 并重复 add。

- Get-CodexMcps 优先调用 `codex mcp list --json`，CLI 不可用时回落到原 TOML 解析
- cua_repl（Codex 自带 ChatGPT.exe 运行时，装在 WindowsApps 下，原 .codex/runtimes
  正则匹配不到）纳入 Test-CodexManaged 自动排除，不再需要每次 -ExcludeName

tools-sync/scripts/sync_mcp_registrations.ps1

@@ -105,7 +105,32 @@ function Get-ClaudeMcps {
     return $result
 }
 
+function Get-CodexMcpsFromCli {
+    # Codex >= 26.8 no longer persists user MCP registrations in config.toml;
+    # `codex mcp list --json` is the authoritative view. Returns $null when the
+    # CLI is unavailable so the caller can fall back to TOML parsing.
+    $codexExe = Get-Command codex -ErrorAction SilentlyContinue
+    if (-not $codexExe) { return $null }
+    $raw = @(& $codexExe.Source mcp list --json 2>$null)
+    if ($LASTEXITCODE -ne 0 -or -not $raw) { return $null }
+    try { $servers = ($raw -join "`n") | ConvertFrom-Json } catch { return $null }
+    if ($null -eq $servers) { return $null }
+    $result = @{}
+    foreach ($s in @($servers)) {
+        $t = $s.transport
+        $transport = if ($t.type) { [string]$t.type } elseif ($t.url) { "http" } else { "stdio" }
+        if ($transport -eq "streamable_http") { $transport = "http" }
+        $result[[string]$s.name] = New-CanonicalMcp ([string]$s.name) $transport ([string]$t.command) `
+            @($t.args) (ConvertTo-StringMap $t.env) ([string]$t.url) `
+            (ConvertTo-StringMap $t.http_headers) ([string]$t.bearer_token_env_var) "Codex"
+    }
+    return $result
+}
+
 function Get-CodexMcps {
+    $fromCli = Get-CodexMcpsFromCli
+    if ($null -ne $fromCli) { return $fromCli }
+
     if (-not (Test-Path -LiteralPath $CodexConfig)) {
         throw "Codex config not found: $CodexConfig"
     }