fix(config): warn on risky Codex CLI extra args (#9548)