feat: support native persistent session queues

[Wolf-L]

Problem and behavior

ACP clients cannot manage Codex's persistent message queue. Simply forwarding queue writes is unsafe: thread/queue/add and cold resume can start generation without session/prompt, leaving output and approvals without an owner.

This adds the negotiated _session/queue extension with list/add/update/delete/reorder/start. Native Codex retains storage and scheduling. The adapter subscribes before generation can start, gives autonomous turns independent event/permission lifetimes, preserves pending entries on interruption, and routes child interactions to their originating turn. Historical replay precedes buffered live output. Each action requires a nonmutating probe of the running native server; native validation errors remain ACP parameter errors.

Lifecycle reservations, generation checks and bounded mutation recovery prevent delayed events/ACKs from writing into replacement sessions. Queue timeout recovery includes owned provider process cleanup; the POSIX supervisor/guardian supports compiled Bun entrypoints. This is an independent PR against main, without the conversation-rewind, file-revert, MCP, archive or other runtime extensions from #596.

Protocol, cancellation semantics, source references, English/Chinese examples and limits: docs/native-queue-controls.md.

Validation

• Ubuntu 24.04, Node 24.14: typecheck/build pass; 1354 passed, 37 skipped.
• Windows queue/lifecycle regression suite: 114 passed.
• Real native Codex 0.160.1, isolated HOME/workspace and loopback Responses fixture: 10/10 checks on Windows and Linux, including 12 negative cases for stale/duplicate reorder IDs, missing start IDs and cross-session access; rejected writes preserve both queues.
• Native coverage includes first idle add before any ordinary prompt, automatic successor output, cancel retaining pending entries, explicit non-head start, and persisted add/update/list across cold restarts.
• All six existing Bun distribution targets compile. Six compiled POSIX process smoke cases pass, including operation without Node on the child's PATH.
• Windows broad suite has 19 failures in four path/history/scenario files; the same 19 failures were reproduced on untouched main (51aa211). They are not reported as passing here. Linux is green.

No real account, real model or user session was used. Loopback model responses and the denying HTTP proxy are environment isolation, not an OS firewall assertion. Source/build hashes and process-exit evidence are recorded by the native harness and uploaded by CI.

Limits

Add to a loaded idle thread can generate immediately. Start can automatically drain subsequent entries. Cancellation racing completion is not atomic whole-queue pause, and external native writers are outside the adapter's local reservation. Native admission and durable removal are separate, so ambiguous add/start results are never automatically retried and exactly-once execution is not promised. Explicit native CODEX_PATH compiled startup is tested; this does not establish compatibility of every external JavaScript launcher. No global installation or Codeg UI changes are included.

中文说明

新增 Codex 原生持久队列的查询、新增、编辑、删除、重排和指定条目启动。继续使用原生存储与调度；不是把队列消息复制成普通 prompt。由于 add 和冷恢复可能自动生成，适配器在派发前接管事件、审批与取消，独立管理自动轮次及子代理归属，并在历史回放结束后发布实时输出。

本轮审查修复了冷加载失败清理、取消启动竞态、旧订阅跨代事件、复用子线程旧审批、隐藏孙任务提前结束等问题。已知参数错误保持参数错误；结果不明不重试，超时使 provider 失效并清理所属进程。独立基于 main，不包含 #596 的回退功能，也不包含其它 Desktop 扩展。

验证：Linux 1354 项通过/37 跳过，Windows 定向114项通过；Windows/Linux真实原生各10项通过，含12个拒绝场景；六个发行目标可编译、POSIX编译产物清理测试通过。Windows完整套件的19项路径问题已在未改主线复现，如实保留。所有模型请求只发往隔离的本地假服务。

取消不是全队列原子暂停，不承诺外部并发写入隔离或 exactly-once；客户端需协商能力并处理队列通知。未改全局安装或 Codeg 界面。