fix(tui): preserve early interrupted prompts in transcripts

[fcoury-oai]

Why

An immediately interrupted prompt must still become a durable transcript event. Before this change, Ctrl+C could arrive while the turn was still starting, so the TUI treated Codex as idle and quit. If interruption arrived slightly later but before model output, the TUI used thread/rollback to remove the prompt and restore it into the composer. Both paths make a submitted user message disappear instead of recording that it was interrupted.

This change gives early interruption the same durable meaning regardless of timing: keep the submitted prompt in the transcript, append the interruption marker, and open a blank composer for the next message. It also removes the TUI's final rollback consumer; the app-server endpoint remains available for other clients.

What Changed

• Treat a turn that is pending startup as cancellable, so the first Ctrl+C interrupts it instead of quitting the TUI.
• Coordinate initial user-input recording across startup, hooks, and abort cleanup so TurnStarted and the transcript user item are each emitted exactly once.
• Preserve hook-filtered input for normal execution while retaining the submitted input for interruption cleanup, without adding an interrupted prompt to model-visible history.
• Wait briefly for abort cleanup to observe any in-flight startup recording before deciding whether it must persist the prompt itself.
• Keep output-free interrupted prompts visible in the transcript, append the interruption marker, and leave a fresh composer.
• Remove the TUI's cancellation-edit, local transcript trimming, and thread/rollback routing machinery.

How to Test

1. Fork an existing session with codex fork <thread-id>.
2. Press Esc twice, select the last prompt, and press Enter to branch the conversation with that prompt restored in the composer.
3. Submit the restored prompt and immediately press Ctrl+C.
4. Confirm the TUI stays open, the submitted prompt remains visible, an interruption marker follows it, and the composer is blank.
5. Resume the source conversation and confirm its transcript remains intact.
6. Repeat with a user-prompt-submit hook and confirm the transcript contains exactly one copy of the submitted prompt.

Focused coverage:

• just test -p codex-core interrupting_regular_turn_waiting_on_startup_prewarm_persists_user_item - passed
• just test -p codex-core interrupt_during_user_prompt_submit_hook_persists_one_transcript_item - passed
• just test -p codex-tui output_free - 2 passed
• just test -p codex-tui ctrl_c_interrupts_turn_pending_start - passed
• just test -p codex-tui - 2,976 passed; the two failures are the existing Guardian feature-flag tests also present in the lower stack layers
• Scoped just fix passed for codex-analytics, codex-core, codex-exec, and codex-tui; just fmt passed
• No pending TUI snapshots

The broad codex-core run reached environment-only failures because the shared target directory does not contain test_stdio_server; the two new core regressions pass independently. The full argument-comment lint is blocked locally by the Bazel LLVM compiler-rt package, and the prebuilt crate-scoped runner is pinned to Rust 1.92 while sqlx 0.9 requires Rust 1.94. The touched Rust diff was manually audited for exact positional-literal comments.

Stack

1. Prompt editing via session forks
2. Safety-buffer retries via session forks
3. Durable early interruption and rollback cleanup (this PR)