docs(release): qualify plain rig in Codex seats by allow_login_shell support

The 0.7.10 notes and the capability-map line now say plain rig works however OpenRig was installed with a Codex that supports allow_login_shell, and the notes add that it hasn't yet run with a live Codex seat.

CHANGELOG.md

@@ -154,8 +154,9 @@ A verified export, a finished task and an exact restore haven't been shown.
   now has the agent point npm's prefix at a folder the person owns whose `bin` is
   on their login PATH, or use a version manager's Node, saying first what that
   changes, and install inside the project only if neither works. ([#2611](https://github.com/mvschwarz/openrig/pull/2611))
-- **Plain `rig` works in managed Codex seats however OpenRig was installed.**
-  OpenRig now passes Codex `-c allow_login_shell=false`, so tool commands run in
+- **Plain `rig` works in managed Codex seats however OpenRig was installed,**
+  with a Codex that supports `allow_login_shell` (checked in Codex's source at
+  0.162.1 and 0.166); not yet run with a live Codex seat. OpenRig now passes Codex `-c allow_login_shell=false`, so tool commands run in
   a non-login shell and inherit the environment their pane's shell set up,
   OpenRig's command folder included. To defer to Codex's own setting instead,
   run `rig config set launch.codex_login_shell true`; it applies at each seat's

docs/reference/whats-new.md

@@ -38,7 +38,8 @@ startup.
   using it; the CA repair is in that file, which the image carries.
 - **Codex tool commands use a non-login shell:** managed Codex seats now pass
   Codex `-c allow_login_shell=false`, so plain `rig` works however OpenRig was
-  installed. Setup that lives only in login or rc files, and shell functions and
+  installed, with a Codex that supports `allow_login_shell` (checked in Codex's
+  source at 0.162.1 and 0.166); not yet run with a live Codex seat. Setup that lives only in login or rc files, and shell functions and
   aliases, may be missing from tool commands, and a model request for
   `login: true` gets Codex's refusal, "login shell is disabled by config". To
   defer to Codex's own setting, run `rig config set launch.codex_login_shell

packages/daemon/context-packs-src/onboarding-width/public-what-you-can-do.md

@@ -811,9 +811,9 @@ version, from checking the environment to a useful report to the OpenRig team.
   Managed Codex launches turn off Codex's startup update check, so no update notice stops them;
   updating Codex is the operator's job.
   Managed Codex seats run tool commands in a non-login shell, so plain `rig` works however OpenRig
-  was installed; setup that lives only in login or rc files, and shell functions and aliases, may
-  be missing there. `rig config set launch.codex_login_shell true` defers to Codex's own setting at
-  each seat's next launch.
+  was installed (with a Codex that supports `allow_login_shell`); setup that lives only in login or
+  rc files, and shell functions and aliases, may be missing there. `rig config set
+  launch.codex_login_shell true` defers to Codex's own setting at each seat's next launch.
 - **`rig seat set-model` / `stop` / `clean`** — persist the model for later managed resumes, stop
   exactly one live seat (ending its session and any work in progress), or clear a dead seat's
   stale binding. A stop is recorded, so the rig doesn't read `degraded` for that seat, and a rig