Split Spark into its own Codex bucket

[iam-brain]

Summary

• split Codex Spark into its own OAuth bucket instead of folding it into the primary GPT bucket
• preserve distinct Spark labels in history and recover Spark-only metadata when OAuth windows exist
• make CLI and menu rendering show Spark consistently even when plan metadata is stale or missing

Validation

• pnpm check
• focused Spark-related tests
• ./Scripts/compile_and_run.sh

Notes

• audited for scope containment and production readiness
• keeps scanner heuristics narrow to avoid unrelated spark false positives