Publish verified Codex lifecycle replay evidence

[minglong51]

Codex capture analysis could not be committed or replayed independently of the complete provider capability grid. This adds a separate canonical JSONL fixture with four source-verified request lifecycles: input, permissions, command approval, and file approval.

The exporter verifies private capture provenance before emitting allowlisted fields with synthetic identities. Offline validation replays the published lifecycle, rejects malformed or contradictory state, and checks the current executable pin. It accepts both observed terminal notification orders and requires idle after request resolution. CI verifies the fixture and preserves coverage of all four request methods.

The records remain explicitly unqualified, with task binding and source health unknown. The capability matrix and production behavior are unchanged. A provider pin change intentionally requires fresh capture exports. Offline CI validates the published artifact; it cannot reverify the private raw source.

Validation:

• 230 tests, including 40 new replay boundary and coverage tests.
• Four fresh Codex 0.155.1 qualification runs passed; all published bytes were regenerated from the retained private captures.
• Input cancellation, empty permission grant, and command/file denial only; isolated credential copies removed and denied targets absent.
• Existing 24-cell capability artifact check and new replay artifact check pass.