Add runtime event telemetry and auth-mode config hardening

.env.example

@@ -1,6 +1,11 @@
 # OpenAI Codex SDK
 CODEX_API_KEY=
 OPENAI_API_KEY=
+# OPENAI_AUTH_MODE: auto | chatgpt | api_key
+# - auto: prefer CODEX_API_KEY/OPENAI_API_KEY when set; otherwise use Codex CLI login
+# - chatgpt: always use Codex CLI login (ChatGPT subscription auth), ignore API keys
+# - api_key: use CODEX_API_KEY/OPENAI_API_KEY when set
+OPENAI_AUTH_MODE=auto
 OPENAI_BASE_URL=
 CODEX_SKIP_GIT_CHECK=true
 MCP_CONFIG_PATH=./mcp.config.json
@@ -45,6 +50,13 @@ AGENT_SECURITY_ENV_SCRUB=
 AGENT_SECURITY_DROP_UID=
 AGENT_SECURITY_DROP_GID=
 
+# Runtime events / telemetry
+AGENT_RUNTIME_EVENT_LOG_PATH=.ai_ops/events/runtime-events.ndjson
+AGENT_RUNTIME_DISCORD_WEBHOOK_URL=
+# AGENT_RUNTIME_DISCORD_MIN_SEVERITY: info | warning | critical
+AGENT_RUNTIME_DISCORD_MIN_SEVERITY=critical
+AGENT_RUNTIME_DISCORD_ALWAYS_NOTIFY_TYPES=session.started,session.completed,session.failed
+
 # Runtime-injected (do not set manually):
 # AGENT_REPO_ROOT, AGENT_WORKTREE_PATH, AGENT_WORKTREE_BASE_REF,
 # AGENT_PORT_RANGE_START, AGENT_PORT_RANGE_END, AGENT_PORT_PRIMARY, AGENT_DISCOVERY_FILE