test: add real CLI MCP smoke

[chicoxyzzy]

Summary

• add an opt-in real Codex CLI smoke path that passes a local stdio MCP echo server through ACP mcpServers and verifies Codex calls its echo tool
• expose a Codex approval-policy selector, including explicit bypass mode, so the smoke and Hecate hosts can request the correct non-interactive tool behavior
• update readiness/testing docs for the MCP smoke coverage and selector surface

Tests

• GOCACHE="/Users/chicoxyzzy/dev/hecate/codex-acp-adapter/.gocache" go test ./...
• GOCACHE="/Users/chicoxyzzy/dev/hecate/codex-acp-adapter/.gocache" go vet ./...
• make real-cli-smoke