Add bounded Codex observer recovery prototype

[minglong51]

A pending Codex input request can now be reconstructed by a new observer process, with readiness withheld until a new thread/read response matches the original thread and session. This Phase 0 prototype adds generation and instance checks, duplicate handling, three-second freshness expiry, and a bounded, private, fsynced replay journal. The capture analyzer also validates thread/read exchanges.

The prototype requires an isolated clilane task launched with an absolute private tmux socket and mode-0700 state/registry directories. The broker and provider stay alive during observer recovery. Named-socket discovery, provider-process restart, and production adapter/ledger/UI integration remain separate work; the public capability matrix stays at 24 unknown cells.

Validation:

• All 122 existing tests passed; repository tests are unchanged.
• 88 disposable scenario groups cover analysis, binding, replay, fencing, expiry, byte/message/time limits, file modes, and journal failure cleanup. Three malformed-argument checks verify redaction.
• A real isolated task and zero-model configuration preflight passed before one bounded live input request. The observer process restarted while the provider process stayed unchanged; the pending request recovered, required fresh session proof, then resolved.
• The complete capture independently analyzes with two bound thread reads, zero warnings, and zero unhandled messages. Journal traffic matches the verified capture in both directions. The private login copy was removed.