fix(studio): run the migration turn on the Sandbox Codex app-server

The migration page could not report the one turn it is watched for most:
`ak migrate` drives Codex itself with `codex exec --json`, and that stream
carries no tool duration, no turn duration and no model, so those rows said
the numbers were not reported while the intelligent build, the analysis turn
and the delivery turn all reported them.

The CLI is closed source, but it calls whatever `codex` is on PATH, and the
Sandbox already hosts a Codex app-server for the Session. Starting a
migration now installs a shim ahead of `codex` on that command's PATH. It
answers only the CLI's `codex exec … --json` form — including `resume <id>`,
`resume --last`, and a prompt on stdin — drives it as one app-server turn,
and writes the app-server's own items back as the `codex exec --json` lines
the page already reads: each tool's `duration_ms`, every item's native name,
and a closing turn line carrying `startedAt`/`completedAt`/`durationMs` and
the model, which `codex exec` can never write.

Anything the shim does not recognise, and any failure to reach the
app-server before the first log line, goes to the real Codex with its
original argv, so the CLI keeps behaving exactly as it did before. The
prompt is only read from stdin once the app-server is going to take the
turn, because a fallback still has to find it there.

Also fixes three shim defects found while testing: a connection lost
mid-turn left in-flight requests waiting forever, a usage update carrying
only the per-turn increment was dropped, and closing the connection could
raise over the turn's own result.

Author: wujiaming-ai