fix(goal): harden blocked-goal hold semantics

[andrei-hasna]

Task: 78b9a1ee-a33b-4924-8c54-4ace858f82a4

Architecture

• Persist and bound deduplicated blocker-audit state by goal, turn, and stable fingerprint.
• Pause the first two matching turn-error observations and transition the third consecutive matching goal turn to blocked, while preserving resume and goal-plan semantics.
• Hold recurring schedules for matching held goals, preserve terminal schedule precedence, and retain default-derived goal objectives across generic submit failures.
• Harden error fingerprint propagation and failure finalization so stale accounting and state-store failures do not corrupt the next turn.

Regression evidence

• git diff --check: pass.
• Focused blocker audit: 4/4 passed.
• Full codex-state: 358/358 passed.
• Full goal_extension_backend: 61/61 passed.
• thread_schedule_runtime: 54/54 passed, 462 skipped.
• Core lifecycle slice: 18/18 passed, 2945 skipped.
• Release invalid_image_lifecycle: 1/1 passed.
• just fmt and just fmt-check: pass.
• Scoped Clippy for all changed crates: pass with explicit allows for two unchanged upstream-only lints (while_let_loop, byte_char_slices).
• just bazel-lock-update and just bazel-lock-check: pass.
• Final moving-base check against aae8f81a: virtual merge clean; only overlapping path was codex-rs/Cargo.lock, whose effective delta is one sqlx dependency entry. cargo metadata --locked and Bazel lock update/check passed on the hypothetical merged tree.
• Redacted committed-range secret scan: 2 commits, no leaks.
• Two independent adversarial reviews: no P0/P1 findings.

Accepted risks and toolchain caveats

• A narrow schedule-finish versus external goal-resume TOCTOU can produce at most one extra fired or paused run; no data-loss path was found.
• The invalid-image regression is release-only by cfg. An unbounded release build exceeded the 8 GiB runner; the bounded release profile passed.
• Combined isolated targets exhausted the 21 GiB runner disk. Exact affected suites were rerun in clean targets and passed.
• Existing Bazel well-known-crate warnings remain unchanged.

No merge, publish, install, restart, deploy, migration, or rollout was performed.

[andrei-hasna]

CI triage disposition: the Windows //codex-rs/hooks:hooks-unit-tests failure is deterministic on the exact base, not introduced by this PR. Base aae8f81a failed beforehand in run 29955421552 (jobs 89043145887 and 89043145714) with the same three trusted-hash/discovery assertions on the same windows-2025-vs2026 image and Bazel 9.0.0; PR job 89045247749 failed identically. fleet_comms.rs and codex-hooks dependencies are identical at base, head, and synthetic merge. No rerun or branch change was made because this is not a flake. Tracked separately in Todos task b36922d5-e6aa-4842-ad0b-aae41c498e2b; it should not be folded into #379.