fix(codex): report the newest known client version when listing models (#64)

The codex model picker only offers GPT-5.5, GPT-5.4 and GPT-5.4-Mini. The models endpoint gates what it returns on the client_version query parameter, and _codex_models_client_version() returned the first value it found, checking models_cache.json before version.json. That cache records whichever CLI last wrote it, so a months-old cache pins the request long after the CLI has been updated:

models_cache.json  client_version 0.134.0   (stale)
version.json       latest_version 0.146.0
codex --version                   0.146.0

Asking the endpoint with each value returns a different list:

0.134.0 -> gpt-5.5, gpt-5.4, gpt-5.4-mini
0.146.0 -> gpt-5.6-sol, gpt-5.6-terra, gpt-5.6-luna, gpt-5.5, gpt-5.4, gpt-5.4-mini

So the newer models were hidden by a stale local file, not by the account. Closes #64.

What changed:

• Take the highest candidate instead of the first. These are lower bounds on what the machine can speak, so max is the right reduction and it self-heals when the CLI updates.
• Compare numerically. String comparison ranks 0.9.0 above 0.146.0. Parsing stops at the first non-numeric segment so 0.146.0-beta.1 does not outrank 0.146.0.
• Raise the built-in floor from 0.133.0, which predates these models. That value is only reached when there is no Codex CLI at all, and it was leaving those users on a pre-gpt-5.6 list.

Nothing else needs to change to use the models. Sending the existing _build_request_kwargs payload for gpt-5.6-sol and gpt-5.6-terra returns HTTP 200 and streams the same event types _normalize_response already handles, and _parse_model_info has no model allowlist.

Worth flagging for your judgement: version.json holds the latest available release, which is not strictly the installed one, so on a machine that has never run an update this can claim a version slightly ahead of what is installed. I preferred it to the alternatives because undershooting fails silently, the model simply never appears, while overshooting fails loudly at request time. Reading codex --version would be exact but spawns a process on a UI path and needs the binary on PATH, which is often not the case for GUI-launched apps on macOS.