Codex accepts --all-accounts but rejects token-account selectors. Match the selected identity before provider deduplication, preserving other providers and stale-request guards. Add a regression fixture that reproduces the official rejection.

Documentation: update usage guidance, CLI evidence, regression coverage, and Unreleased. TODO retains authenticated account verification and setup blockers; no tracked parity item is completed.