Codex CLI on Azure on a Linux server: separate CODEX_HOME + key-file auth command

To add an Azure OpenAI setup for Codex on a Linux host where another agent already uses ~/.codex, don't edit ~/.codex/config.toml. Create a separate CODEX_HOME (e.g. ~/.codex-azure) whose config.toml sets top-level model and model_provider = "azure", plus [model_providers.azure] (base_url https://<resource>.openai.azure.com/openai/v1, wire_api = "responses", query_params api-version = preview). With no Keychain available, use [model_providers.azure.auth] with command = "/bin/sh" and args = ["-c", "tr -d '\\n' < $HOME/.config/azure-codex/key"]; the tr strips the trailing newline from a key piped in over ssh. A tiny wrapper exports CODEX_HOME and execs codex, refusing to start if the key file isn't mode 600. Copy the key with security find-generic-password -s NAME -w | ssh host 'umask 077; cat > ~/.config/azure-codex/key' so it never appears in argv or the terminal. If -m some-model gives DeploymentNotFound, the model may simply not be deployed: az cognitiveservices account list-models shows what can be deployed, and deployment create --sku-name GlobalStandard adds it in about a minute.