feat: add durable peer design and research workflows

[CBEPX]

Summary

• add durable $cc:design and $cc:research peer workflows across independent Codex and Claude branches
• enforce fail-closed sandboxing, selected-only MCP probing, content-free pre-reveal progress, one-shot attempt leases, and atomic workflow transitions
• add bounded retry/session recovery, aggregate status/result/cancel surfaces, acceptance coverage, and v1.7.0 documentation

Review

• strongest Codex whole-branch review plus Claude Opus standard and adversarial reviews completed
• one consolidated fix wave closed all eight mandatory findings
• final scoped rereview: 8/8 PASS, 17/17 focused tests, no Critical/Important blockers, READY

Exact-head verification

Head: 772b7b06abaa6c57508fb745dc9eb8273a34f53d

• npm run check: 904 unit, 102 integration, 23 E2E
• coverage: 92.50% statements/lines, 82.90% branches, 98.24% functions
• forced PR mutation, no reuse: 82.65% critical, 74.69% managed, 66.39% installer
• package dry-run: 89 entries, 647454 bytes
• public skill validators: 5/5
• branch git diff --check: clean
• Gitleaks: 524.93 KB scanned, no leaks

Remaining qualification

Real Claude sandbox plus a selected stdio MCP is intentionally a post-install live smoke after the v1.7.0 release is pinned locally and Codex is restarted.