fix(companion): harden task path parsing and availability probes - #574

Audited against open upstream reports on openai/codex-plugin-cc; each defect
was reproduced or verified against this fork and has a regression test in
tests/substrate.test.mjs (dedicated fake app-server).

- openai#302 unbounded waits: every RPC has a bounded wall-clock timeout (120s
  default, command/exec aware, CODEX_COMPANION_RPC_TIMEOUT_MS, 0 disables),
  and requests on a dead connection fail immediately. The turn watchdog does
  not use a silence timeout (legitimate turns are silent for long periods):
  it fails fast when the connection closes, and after quiet periods asks the
  app-server via thread/read whether the thread is still active, recovering a
  turn whose completion event was lost and failing only an app-server that
  stops answering.
- openai#453 zombie broker: the broker exits when its app-server child dies, so the
  next caller starts a healthy broker instead of wedging.
- openai#706/openai#707 retained subscriptions: the broker tracks per-socket thread
  ownership (subagents inherit their parent's owners) and sends
  thread/unsubscribe when the last owner disconnects; requests for a thread
  wait (bounded) for its in-flight unsubscribe. Simpler than openai#707 because this
  broker already serializes active requests and streams.
- openai#762 + openai#768 together: broker acquisition is serialized; a broker whose
  process is alive is never torn down or killed because it missed a probe
  (the caller uses a private app-server); metadata is cleared only when the
  process is provably gone; only a just-spawned broker that never became
  ready is killed, identity-checked. SessionEnd's kill is identity-checked.
- openai#574 RC3: non-retryable errors fail a turn even when completion is
  inferred. The upstream fix (any error fails) is wrong: error notifications
  carry willRetry, and retried turns can succeed.
- openai#775: fileChange start events without a change list no longer throw.
- openai#740 reproduced with real Codex 0.144.1: live thread/resume ignores the
  requested sandbox in both directions (write-capable threads stayed writable
  after a read-only resume), and a per-turn override persists to later turns.
  Every turn now sends an explicit sandboxPolicy.

Also fixes a same-process withFileLockAsync bug (a second async holder
treated the first as stale) and makes the test harness stop brokers when a
test process is killed by a signal.

Validation: npm test 156/156, tsc clean, no stray processes.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

Both by Codex tickets through this fork, independently verified and reviewed:
- stock-fixes (upstream openai#393/openai#574 RC1-RC2, openai#757/openai#763): availability probes no
  longer mistake a missing cwd for a missing Codex; the prompt/flag boundary
  applies only to single raw-string input (slash commands, the rescue
  forwarder), where re-tokenization made "-m pytest" a model; failed turns
  persist a readable errorMessage and summary. Turn 1 regressed 17 tests and
  was returned with the failing output; turn 2 fixed the design.
- fix-integration turn 3 (ran on a fresh thread via the resume fallback):
  interrupted-integration recovery restores only entries still in their
  intended post-integration state and refuses, by name, paths the lead
  changed after the crash, keeping the journal.

Validation: npm test 164/164, tsc clean, no stray processes; all dogfood
tickets closed with decision records and their worktrees and refs removed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>