fix(codex): deliver native context and durable session records - #627

Codex could miss subagent context and shell-read priming, while SessionEnd package startup could exceed the host's three-second timeout. This change delivers scoped project/role context to native subagents, primes project memories from explicit shell file cues, and durably queues SessionEnd before starting the package runtime.

Native Codex encrypts the subagent task supplied to hooks. Opaque tasks are preserved unchanged and the resulting briefing is labelled as project/role context. Plaintext host events retain task-aware retrieval. PostgreSQL and SQLite both apply project scope before limiting results.

The SessionEnd worker retains failed jobs, recovers them at SessionStart and makes lifecycle replay idempotent. The release updates all version surfaces to 4.23.2 and verifies the candidate wheel's full MCP surface in CI.

Validation:

• 279 affected tests passed without skips or warnings; real disposable PostgreSQL and SQLite coverage.
• Native Codex 0.154.0 child received both seeded context markers; a file read raised project heat from 0.3 to 0.4 while the sibling-project control stayed at 0.3.
• Native SessionEnd produced one session record and one receipt with no pending job. Intake measured 64–65 ms in three observations.
• Packaged wheel initialized, exposed 59 tools and answered memory_stats from a clean candidate cache.
• Six priming and four lifecycle mutations were detected; Ruff, craftsmanship, source discipline, wiki and version checks passed.

ADRs 1084–1086 and docs/verification/codex-native-4.23.2.md document the contracts and reproduction. Native Windows crash durability has not been measured.

Final integration validation at 62b44c5:

• Full Python 3.10, 3.11, 3.12 and 3.13 jobs passed.
• Full SQLite job passed: 8,768 tests and 460 subtests; backend/platform exclusions are recorded by the suite.
• Python 3.11 passed 9,065 tests and 460 subtests.
• Windows installation subset passed 127 tests.
• Packaged full-profile MCP check passed with 57 tools on Linux; type check reported zero diagnostics.
• CI regressions covering transcript receipt identity, optional-driver imports, lightweight hook imports and full-tool enforcement pass together: 63 tests.