[codex] Fix watchdog death detection and resume target

[palios-taey]

Summary

Fixes task-4fb37e4e for the watchdog restart path. The change separates probe failure/timeout from definitive Claude process absence, adds restart fail-safes, and resumes using the pane-specific Claude sessionId instead of the global latest conversation.

Root Cause

_claude_running() returned only a boolean, so a probe timeout or tmux/pstree failure was treated the same as a confirmed missing Claude process. Under load, that could restart an alive-but-stalled session. _restart() also accepted commands like claude --resume latest, which can resume the newest global conversation rather than the tmux pane's own session.

Changes

• Return True / False / None from Claude liveness probing, where None means unknown and never restarts.
• Require multiple consecutive definitive-dead polls before restart (CCW_DEAD_CONFIRM_POLLS, default 2).
• Suppress restarts when system load is above cpu_count * CCW_RESTART_LOAD_MULTIPLIER (default 4).
• Resolve the pane pid cwd to ~/.claude/projects/<sanitized-cwd>/, read the newest .jsonl, and substitute its sessionId into {session_id}.
• Refuse resume commands that target latest or omit {session_id}.
• Update README/SECURITY docs and add tests for the fail-safe paths.

Validation

• python3 -m unittest discover -s tests -v -> 36 tests passed.
• python3 -m py_compile watchdog.py tests/test_watchdog.py -> passed.
• git diff --check -> passed.
• python3 watchdog.py --help -> verified help documents {session_id} and refuses latest.
• Live tmux acceptance against real tmux/pstree/process state:
  • PASS live true-dead session restarts with pane-specific session id
  • PASS live extreme-load guard suppresses restart
  • PASS live probe-unknown path suppresses restart
• GitNexus impact was run before edits for _claude_running, _restart, check, and Watchdog; _claude_running, _restart, and check reported HIGH blast radius.
• npx gitnexus detect-changes --scope staged -r claude-code-api-watchdog returned No changes detected despite the staged diff, so this PR records that as a GitNexus detection blind spot rather than evidence of no code changes.

Deployment Note

I did not reinstall /usr/local/bin/watchdog.py, change the watchdog launcher, or re-enable --resume-cmd in production. This is intentionally left for r5 gate + Jesse validation + deploy control.