Fix scheduled Codex option order

Request:
- Fix hk-ipo-analyst.service failing with 'unexpected argument -a' when the scheduled runner invokes Codex.

Changes:
- Moved Codex global options before the exec subcommand in scripts/run_hk_ipo_analyst_once.sh.
- Kept the existing scheduled prompt and systemd units unchanged.
- Reset the failed hk-ipo-analyst.service state after the previous invalid-argument failure.

Verification:
- Ran bash -n scripts/run_hk_ipo_analyst_once.sh.
- Ran git diff --cached --check.
- Confirmed 'codex --search -s danger-full-access -a never exec -C /root/projects/hk-ipo --help' parses successfully.
- Ran systemd-analyze verify for the service and timer; only unrelated system xfs unit warnings were reported.

Next useful context:
- I did not start hk-ipo-analyst.service after this fix to avoid triggering a full analyst refresh outside the timer window.

scripts/run_hk_ipo_analyst_once.sh

@@ -38,8 +38,9 @@ EOF
 )"
 PROMPT="${PROMPT_TEMPLATE//__AS_OF__/${AS_OF}}"
 
-codex --search exec \
-  -C "${REPO_ROOT}" \
+codex --search \
   -s danger-full-access \
   -a never \
+  exec \
+  -C "${REPO_ROOT}" \
   "${PROMPT}"