codex: stop managing ~/.codex/.gitignore via home-manager

~/.codex is a git-sync-rs checkout of codex-history, which ships its own
real .gitignore. An HM-managed symlink there resolves to a symlink-blob
(the target path), silently disabling all ignore rules — git won't read a
symlinked ignore file. That let a git-sync auto-commit stage auth.json,
*.sqlite and ~540 other state files locally (caught before push; remote
was never affected). Leave .gitignore to the repo.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nix-shared/home-manager/codex-generated-skills.nix

@@ -55,10 +55,11 @@ in {
 
   config = lib.mkIf cfg.enable {
     home.file = {
-      ".codex/.gitignore" = {
-        force = true;
-        source = oos "${cfg.worktreeCodexDir}/.gitignore";
-      };
+      # NB: ~/.codex/.gitignore is intentionally NOT managed here. ~/.codex is
+      # a git-sync-rs checkout of the codex-history repo, which ships its own
+      # real .gitignore — git refuses to read a symlinked ignore file, so an
+      # HM-managed symlink here would silently disable ignore rules and risk
+      # committing auth.json/sqlite state. Leave it to the repo.
 
       ".codex/AGENTS.md" = {
         force = true;