[codex] Repair stale Desktop thread model state

[dilong888]

Summary

• add a narrowly scoped sync-codex-thread-model.ps1 repair for explicitly identified Desktop threads whose persisted model / reasoning_effort state is stale
• require one or more thread IDs and preview by default; writing requires -Apply
• update only non-archived user-thread SQLite rows and the matching rollout session_meta, with timestamped SQLite and rollout backups
• refuse -Apply while Codex is running, and document the distinction between provider-history recovery, stale per-thread state, and upstream streaming failures

Problem

After a Desktop update or a UI model switch, an old thread can retain stale local model / reasoning_effort state even though Desktop UI or rollout metadata already shows the intended model. This can leave persisted thread state split from the effective session state.

This is not a fix for a model provider, a model itself, or errors such as stream disconnected before completion.

Scope and safeguards

• requires explicit thread IDs
• restricts matches to active thread_source='user' rows under the specified provider and expected old model
• supports an optional expected reasoning-effort guard
• previews by default; -Apply is required for writes
• updates only SQLite thread state plus the rollout first-line session_meta
• refuses a partial repair when a selected thread lacks a usable rollout
• does not modify config.toml, workspace roots, or arbitrary JSONL event fields

Validation

• sync-codex-thread-model.ps1 -SelfTest
• PowerShell parse check for all scripts/*.ps1
• git diff --check
• dry-run against a previously repaired thread returned selected_count: 0 without writing Desktop state
• -Apply was verified to refuse while Codex is running