Harden Codex stop gate supervision

[gon7187]

Summary

• make tracked Codex jobs crash-safe and prevent cancelled or removed work from resurrecting
• serialize state mutations, reconcile dead workers, and make cancellation outcomes authoritative
• make the Stop review gate fail closed, single-flight, and reusable for the exact Claude response

Root cause

The detached worker could start before its queued record was durable. Mutable lifecycle writes, SessionEnd cleanup, cancellation, and concurrent Stop hooks could then race, leaving queued zombies, duplicate reviews, or stale ALLOW output.

Verification

• npm test — 138/138 passing
• npm run build
• npm run check-version
• node --check on every changed .mjs file
• git diff --check origin/main...HEAD
• independent architecture and code-quality reviews found no Critical or Important issues

Deliberate tradeoff

A zero-byte .removed tombstone is retained per retired job. It is the smallest daemon-free guarantee that a paused late worker cannot publish or run after removal; mutable job files, logs, and lifecycle sidecars are still cleaned up.