Recover stalled completed Codex sessions

[mdashjames]

A local codex exec --json run can finish its root turn but stall during CLI shutdown. In the observed Codex 0.154 failure, the root rollout persisted task_complete with its final message while the exec JSON stream stopped and the Codex/code-mode processes remained alive, so AgentFlow waited until the much larger node timeout.

For local, non-ephemeral Codex executions with a scoped CODEX_HOME, this adds a narrow fallback monitor. It snapshots existing rollout files before launch, captures the root thread ID from thread.started, and reads that rollout only from the invocation boundary. It accepts a terminal event only after a new matching task_started, and continues scanning during the normal-shutdown grace period so a newer retry invalidates an earlier completion. Completed turns recover the final agent message and terminal trace event; aborted turns remain failures. AgentFlow's configured success checks still run afterward.

Local Codex launches enter a separate POSIX session. Root exit is detected from the subprocess return code independently of stdout/stderr EOF, because descendants can inherit those pipes. Recovered completion, cancellation, timeout, and normal-exit cleanup signal the isolated process group, wait for both the direct process and group to disappear, and escalate from SIGTERM to SIGKILL. The root exit code is preserved. Non-POSIX launches retain the existing direct-process behavior.

Validation:

• 15 focused local lifecycle tests pass, including normal root exit with an inherited-pipe descendant, same-thread retry handling, partial and delayed terminal stdout, and nonzero natural exits during external-completion grace even while the polling waiter remains pending.
• 6 Docker external-completion tests pass.
• compileall and git diff --check pass.