fix(codex): reap app-server groups after wrapper death

[myobie]

Summary

• Put each Codex app-server in a process group led by a liveness watchdog.
• Keep the watchdog alive through a wrapper-owned channel.
• Remove the owned socket and kill the exact group when the wrapper disappears.
• Use RAII cleanup for clean returns, startup errors, and Rust unwinds.
• Reject a second live socket owner and remove a dead socket before launch.

Red-before proof

On main at 55efd31, this command failed:

cargo test --lib codex_app_server::tests::an_app_server_group_dies_when_its_wrapper_is_killed -- --exact --nocapture

The failure was the app-server survived its wrapper. The test also observed the socket after it killed only the wrapper. The test removed the residual process and socket before it returned.

The same test passes with this change.

Exit paths

• Explicit termination kills and reaps the complete owned group.
• Drop performs the same cleanup for Rust errors and unwinds.
• Wrapper exit, crash, SIGKILL, and supervisor teardown close the liveness channel.
• The watchdog removes the socket before it kills its own group.
• A startup spawn failure kills and reaps the watchdog before returning.
• The watchdog remains the group leader, so its group ID cannot identify another live owner.

Checks

• cargo fmt --check
• git diff --check
• cargo test --lib codex_app_server::tests --all-features — 49 passed
• cargo test --test codex_app_server --all-features — 4 passed
• cargo test --test codex_hooks --all-features — 5 passed
• cargo test --all-targets --all-features — 467 library tests passed. The existing incomplete_apply_marker_blocks_declarations_but_not_the_state_plane integration test then failed. It fails the same way on untouched main in a separate worktree.
• The documented Clippy command is already red on current main for unrelated existing lints. This change introduces no compiler warnings.
• No evals ran because the fleet eval stop remains active.

[myobie]

PR #386 now contains this process-group reaping change and the Codex protocol admission change. The combined branch passes its focused and full library tests. This PR is superseded by #386.