Codex monitor: persist actas role and require visible handling across restarts

[ryofukutani]

Problem

Codex Desktop delivery can lose the selected role after restart or compaction, and a headless codex exec resume fallback can process messages outside the visible chat. Switching that fallback to turn mode also removes SessionStart, so monitoring no longer restores on the next restart.

Proposed behavior

• Persist the last explicit Codex actas role per project.
• Install SessionStart and the visible Stop-hook fallback together for Codex monitor mode.
• Rebind the saved role on SessionStart.
• Prefer visible app-server turns; keep headless codex exec resume disabled unless explicitly opted in.
• Peek unread rows without consuming them, then mark only displayed IDs after the visible turn completes.
• Require visible sender, plan, major actions, reply result, blockers, and next step in the injected turn.
• Stop app-monitor processes even when no bridge pidfile exists.

Acceptance

• Restart-equivalent SessionStart restores the saved role.
• Multi-role Stop delivery polls the saved role rather than the first registration.
• Monitor mode retains SessionStart while arming the visible fallback.
• A failed or unavailable headless transport preserves unread rows.
• Focused Bats tests cover persistence, visibility, unread ownership, and teardown.

Refs #263 and #361.