fix(tui): retry safety-buffered turns using session forks

[fcoury-oai]

Why

The safety-buffering prompt can offer to retry a slow request with a faster model. Today that retry interrupts the active turn and then calls thread/rollback, mutating the source conversation before resubmitting the prompt. This couples an otherwise optional retry to destructive history editing and can leave local transcript state out of sync if the new submission fails.

This change treats the retry as a new conversation derived from the source. The interrupted thread remains intact, while the retry starts from the last canonical completed turn and submits the original prompt on the derived thread.

What Changed

• Record the submitted prompt alongside the safety-buffered turn so the retry does not depend on early-cancel composer state.
• Interrupt the active turn, read its canonical history, and fork through the immediately preceding forkable turn.
• Start a fresh thread when the interrupted request is the true first turn; reject synthetic predecessors instead of silently dropping context.
• Attach the derived thread and submit the faster-model retry transactionally, rendering the local prompt row only after turn/start succeeds.
• Remove the safety retry's rollback origin and related routing while retaining rollback for early interruption until the next stack layer.

How to Test

1. Start the TUI and submit a request that receives the safety-buffering prompt.
2. Choose Retry with a faster model.
3. Confirm the TUI moves to a derived conversation, retains history through the previous completed turn, and submits the same prompt with the faster model.
4. Resume the source conversation and confirm its interrupted turn and earlier history remain intact.
5. Repeat on a first-turn request and confirm the retry starts in a fresh conversation.
6. Interrupt an ordinary output-free request and confirm the existing prompt-restoration behavior still works in this layer.

Focused coverage:

• just test -p codex-tui safety_buffer — 10 passed
• just test -p codex-tui cancelled_turn_edit — 2 passed
• just test -p codex-tui prompt_edit — 3 passed
• just test -p codex-tui — 2,984 passed; the two remaining failures are the existing Guardian feature-flag tests on main

Stack

1. Prompt editing via session forks
2. Safety-buffer retries via session forks (this PR)
3. Durable early interruption and rollback cleanup

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dc9d0472f3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".