fix(codex-app-server): deflake darwin-parallel test races

[schickling]

Fixes #315

Problem

Two codex_app_server lib tests fail intermittently under full-suite parallel load on macOS arm64 while passing deterministically in isolation (rate table + panics in #315):

• process_group_cleanup_reaps_a_native_launcher_descendant → ParseIntError { kind: Empty }
• subscribed_control_pump_delivers_a_typed_reference_to_the_real_fifo_head → Attempted != Accepted

Baseline on main (d29c37f2), five full-suite runs across two days: 3 of 5 failed, always exactly one of these tests.

Root causes

1. The launcher shell does printf "%s" "$$" > pidfile: the file is created before the bytes land. The test waited for is_file() then read once — an empty read under load panics on parse.
2. The test asserted delivery-state == Accepted immediately after joining pump and fake-server threads. The pump persists Accepted synchronously, but its final websocket frames race the fake server's exit under descheduling, so the pump can terminate before processing item/completed.

Fix (tests only, no production changes)

1. Wait for parseable pid content within a bounded deadline instead of a single read after existence.
2. Poll for the Accepted outcome (bounded 10s), bail early if the pump dies, then join and assert. Same contract — delivery must reach Accepted — observed load-tolerantly.

Verification

macOS arm64, fix commit, three consecutive full-suite runs:

RUN1: test result: ok. 349 passed; 0 failed
RUN2: test result: ok. 349 passed; 0 failed
RUN3: test result: ok. 349 passed; 0 failed

Linux x86_64: cargo test -p st2 --lib → 355 passed; 0 failed.
Isolation loops post-fix: both targets 10/10 pass.

Complexity

Test-only; ~20 lines across two tests, no new abstractions.