fix(runner): classify failures from current terminal diagnostics

[Haloukaidi]

Recovered stderr can still turn a current 503/SSE failure into an authentication failure after #102. It can also affect retry ownership and pre-provider refusal accounting, while an earlier recoverable error can hide the stop reason that actually terminated the process.

Select the current terminal diagnostic once and share it across result translation, auth detection/replay, and refusal checks. Preserve raw stderr separately. Startup fallback uses the latest diagnostic only for a generic receipt without model progress; a sticky progress flag survives bounded event capture. An actual watchdog stop replaces an earlier recoverable error. Codex terminal errors also replace prior diagnostics when their message is empty, while the execution-host failure handling added in #104 remains authoritative.

The existing Manager wall-clock timeout behavior is retained for a final explicit reconnect/429 notice: it is a narrow cooldown scheduling hint, not an auth diagnostic or a replacement for an operator-stop receipt.

Validation on Windows / Python 3.13:

• 208 tests passed across terminal diagnostics, stop receipts, upstream receipt classification, execution-host failure, stream callbacks, and the agent backend.
• Coverage includes current 503/SSE/429 after recovered 401, genuine startup refusal, auth replay count, stop precedence, bounded history, and empty terminal errors.
• Ruff and git diff --check passed.

Draft for review of the shared diagnostic contract and remote CI. Refs #102 and #104; their already-fixed cases remain covered.