Add work Codex MCP setup and append helpers

[Clsan]

What's changed

• Add append_block_if_missing as the common idempotent file helper.
• Add append_line_if_missing on top of append_block_if_missing, and replace the old add_to_zshrc helper.
• Retry cask installs after a targeted brew update when Homebrew metadata is stale, with clearer cask install/skip logs.
• Rename the GitHub Actions workflow from lint to ci because it also runs macOS smoke setup.
• Install Codex and mcp-grafana during work setup.
• Add empty-safe Grafana env placeholders to ~/.zshrc: GRAFANA_URL and GRAFANA_SERVICE_ACCOUNT_TOKEN.
• Add missing MCP blocks to ~/.codex/config.toml for Grafana, Datadog, and Channel Teamchat without overwriting existing entries.
• Run codex mcp login datadog and codex mcp login channel-teamchat during interactive work setup.

Notes

Claude Code is already installed in work_setup.sh. I kept Codex in the same work-only layer because these MCP defaults are work-specific observability/teamchat tools. If we want Codex for personal machines too, I would split only the Codex cask install into setup.sh and leave these MCP blocks in work_setup.sh.

Verification

• /bin/bash -n common.sh setup.sh work_setup.sh
• for f in *.sh; do /bin/bash -n "$f" || exit 1; done
• shellcheck --severity=warning --exclude=SC2016 *.sh