fix: ensure Codex passthrough path sets instructions and store=false

The native Codex passthrough path returned early before injecting
default instructions and enforcing store=false. Clients sending
Responses API requests without instructions (e.g. opencode) got
400 "Instructions are required", and requests missing store=false
got 400 "Store must be set to false" from the Codex upstream.

Move both assignments before the passthrough return so they apply
to all code paths.

open-sse/executors/codex.ts

@@ -260,11 +260,9 @@ export class CodexExecutor extends BaseExecutor {
       body.service_tier = CODEX_FAST_WIRE_VALUE;
     }
 
-    if (nativeCodexPassthrough) {
-      return body;
-    }
-
     // If no instructions provided, inject default Codex instructions
+    // NOTE: must run before the passthrough return — Codex upstream rejects
+    // requests without instructions even when the body is forwarded as-is.
     if (!body.instructions || body.instructions.trim() === "") {
       body.instructions = CODEX_DEFAULT_INSTRUCTIONS;
     }
@@ -272,6 +270,10 @@ export class CodexExecutor extends BaseExecutor {
     // Ensure store is false (Codex requirement)
     body.store = false;
 
+    if (nativeCodexPassthrough) {
+      return body;
+    }
+
     // Extract thinking level from model name suffix
     // e.g., gpt-5.3-codex-high → high, gpt-5.3-codex → medium (default)
     const effortLevels = ["none", "low", "medium", "high", "xhigh"];