Qualify denied Codex actions and cover observer boundaries

[minglong51]

Codex qualification now exercises command and file-change approvals, declines each exact synthetic action, and verifies that the pending request survives observer restart, resolves, and leaves its target absent. The probe accepts only the pinned provider's expected denial diagnostic within the matching response/turn window; all other stderr still fails.

Add 68 regression tests for protocol parsing, identity binding, duplicates, freshness, replay, private journals, credential cleanup, and qualification boundaries, and run them in macOS/Linux CI. Repin Claude to 2.1.283 after executable identity and native initialize/SessionStart checks; retain Kimi's existing pin pending session compatibility.

Validation:

• 190 Python tests pass locally.
• Provider evidence artifact check passes for all 24 cells.
• Live pinned Codex input, empty-permission, declined-command and declined-file scenarios pass; source captures and journals were independently checked.
• Copied credentials were removed, completed probe sessions closed, and denied targets remained absent.
• Independent source review found and verified the fix for run paths containing spaces/shell characters.
• Cross-provider review passed on the final patch; two initial scope misunderstandings were independently reproduced and refuted without weakening checks.

Capability status remains unqualified. Claude model-turn/UserPromptSubmit/Stop behavior, Kimi session compatibility, and production reconnect integration are still outside the evidence proved by this change.