Permit Codex delivery after terminal errors

[myobie]

What changed

• Keep systemError held until the failed turn completes.
• Convert the completed error to TerminalError { SystemError }.
• Permit turn/start from that terminal diagnostic.
• Keep notLoaded, review, compaction, human-wait, and conflicting-turn states blocked.
• Add a focused deadlock regression.
• Add a payload-minimized replay of all 23 inbound frames from the docs(vrs): record observed harness state experiments #263 usage-limit capture.
• State the provider-native delivery rule in the Codex harness specification.

Why

Codex and st2 deadlock after a terminal system error. Codex clears the error only when a new turn starts. st2 refuses to start a turn while it holds SystemError. Each side waits for the action that only the other side can cause.

#270 fixed the false ConflictingTurn label. It correctly preserved the provider's reported SystemError, but it left the delivery gate shut.

The provider sends no later signal that can open that gate:

• EventMsg::Error calls note_system_error.
• note_system_error sets has_system_error = true.
• turn/completed calls note_turn_completed.
• clear_active_state does not clear has_system_error.
• An unchanged status suppresses the notification.
• note_turn_started clears the error.

The upstream system_error_sets_idle_flag_until_next_turn test never asserts Idle. It asserts SystemError, starts the next turn, and then asserts Active.

Recorder limit

The two #263 capture files stop at turn/completed and have the same method sequence. Their endings cannot prove that Codex omits a later idle event. The replay test pins only the st2 state at that recorder boundary. The provider source above proves that no later idle notification arrives.

User impact

A failed Codex turn no longer wedges native inbox delivery. The next unread message can start the turn that clears the provider error.

Validation

• cargo test -p st2 --lib codex_app_server::tests -- --nocapture: 40 passed.
• cargo test -p st2 --lib -- --nocapture: 327 passed.
• git diff --check origin/main...HEAD: passed.

Fixes #264

[myobie]

@schickling, was this close deliberate, or was it repository tidy-up?

If it was deliberate, what fix shape would you accept for #264 instead?

Should I continue with the unrelated draft #276? I will follow your preference.