docs: document codex-api provider diagnostics

docs/reference/dev-runtime-boundary.md

@@ -127,14 +127,21 @@ references, and non-secret egress/runtime settings:
 | Provider env | `HWLAB_CODE_AGENT_PROVIDER=codex-stdio` |
 | Model env | `HWLAB_CODE_AGENT_MODEL=gpt-5.5` |
 | Provider Secret | `OPENAI_API_KEY` from `hwlab-code-agent-provider/openai-api-key` |
-| DEV egress/base URL | `HWLAB_CODE_AGENT_OPENAI_BASE_URL=http://172.26.26.227:17680/v1/responses` |
+| DEV egress/base URL | 按 profile 独立配置；`deepseek` 走集群 bridge，`codex-api` 走同 Pod loopback forwarder，forwarder 直连 hyueapi 且必须保留 `NO_PROXY` |
 | Workspace | `HWLAB_CODE_AGENT_CODEX_WORKSPACE=/workspace/hwlab` with `workspace-write` sandbox |
 | Codex state | `CODEX_HOME=/codex-home` |
 | Codex command | `HWLAB_CODE_AGENT_CODEX_COMMAND=/app/node_modules/.bin/codex` |
 
-DEV pods must not call `https://api.openai.com/v1/responses` directly. The base
-URL must use the approved DEV egress/proxy path so provider reachability is a
-repeatable deployment contract instead of a one-off runtime patch.
+DEV pods must not call `https://api.openai.com/v1/responses` directly. G14
+`codex-api` must send Codex CLI/app-server traffic to a same-Pod `127.0.0.1`
+loopback forwarder; that forwarder direct-connects to `hyueapi.com` /
+`.hyueapi.com` and keeps both domains in `NO_PROXY` and `no_proxy`. DeepSeek uses
+the cluster bridge/Moon Bridge path. `http://172.26.26.227:17680/v1/responses` is
+only a D601 legacy egress or Code Queue runner comparison clue after the migration
+to G14, not a G14 default runtime contract. Provider reachability must be proven by
+the target pod minimal closure described in [Code Agent Chat Readiness Runbook](code-agent-chat-readiness.md),
+not by a one-off runtime patch or by pushing full CI/CD while the closure is still
+failing.
 
 Reports, smokes, and health payloads may show Secret name/key presence,
 `missingEnv`, provider status, model, trace IDs, and redacted egress status.