--setup-codex writes notify under [tui] instead of TOML root

[ZenithalHourlyRate]

Summary

agent-notify --setup-codex appends notify = ["..."] to the end of ~/.codex/config.toml. If the file already ends inside a TOML table such as [tui], the new key is written into that table instead of the top level.

That leaves Codex without a top-level notify hook, so notifications do not fire even though setup reports success.

Reproduction

1. Create a Codex config that already has a table:

model = "gpt-5.4"

[tui]
status_line = ["model"]

2. Run:

agent-notify --setup-codex

3. Inspect ~/.codex/config.toml.

Actual behavior

The current implementation appends this to the end of the file:

notify = ["/path/to/agent-notify"]

Because it is appended after [tui], TOML parses it as [tui].notify, not as the top-level notify key Codex expects.

Expected behavior

--setup-codex should ensure notify is written at the TOML root, typically before the first table header.

Notes

I reproduced this locally with the current main branch and prepared a fix that prepends the root-level key and adds a regression test.