fix: harden companion runtime contracts

[CBEPX]

Summary

• separate worker lifecycle ownership from the cancellable Claude child, identity-guard orphan cleanup, and make progress writes terminal-safe
• make forwarding wait for real command exit, announce failed terminal outcomes, and align owner-scoped resume candidate/execution behavior
• classify Fable quota and Claude authentication failures safely, add read-only setup preflight, and write Codex config atomically
• add canonical wait-timeout flags, installed-cache diagnostics, Windows lifecycle coverage, and release metadata for v1.5.4

Verification

• npm run check on the feature branch: 734 unit, 80 integration, 22 E2E
• npm run check again on the local fast-forward merge into exact cbepx/main: 734 unit, 80 integration, 22 E2E
• npm run test:lifecycle-contract: 8/8
• npm pack --dry-run: cc-plugin-codex@1.5.4, 78 entries
• git diff --check: clean
• two foreground Claude Code reviews completed; substantive findings were resolved before the exact-head gates

Dependency audit

• npm ci reports 2 existing high-severity audit findings; this change does not alter dependency versions

Release boundary

No v1.5.4 tag, GitHub Release, downstream publication, or live plugin activation has been performed yet.