Establish Codex typed API foundation and operation contracts

[VolkerChristian]

Phase A1.0

One PR, one feature branch, and exactly two review/validation commits above master at 6c0396526c6a06cd2f3d9a05e7d24163c9a980e6:

1. 7377f3581bab2af0bf3e18edbfbb49a91157d03b Establish offline Codex operation evidence
2. cfc129ec879c70fc09c165035f6d1390f61289b8 Introduce Codex typed foundation and migrate existing surface

A1.0a — offline evidence and fixtures

• Vendors and integrity-guards the minimal authoritative upstream Rust source for Codex App Server 0.144.6.
• Derives 87/87 stable client request/result contracts from vendored Rust and 10/10 stable server-request response contracts from paired schemas.
• Records the pinned TypeScript audit honestly: its generated tree contains no independent request-to-response mapping.
• Extends the sole production protocol registry with operation contracts, frozen A1 slice assignment, nested reachability, and mechanically derived completeness.
• Adds an offline Draft-07 validator, deterministic schema-derived fixtures, generated reports, exact-code mutation guards, and source/binary packaging policy.
• Final A1.0a boundary: GCC Debug 249/249, Codex 78/78, focused Clang 7/7, ASan/UBSan/LSan 7/7, staged install and source/binary package audits passed. The established credential/quota-gated typed integration was skipped.

Commit 1 CI: run 30028759871 / #314 completed successfully.

A1.0b — typed foundation and migration

• Adds the installed grouped typed::Client facade and AppServerClient::typed(); the old four accessors remain deprecated source-compatible forwarders.
• Keeps AppServerClient at its existing PIMPL-only layout and reuses the existing raw connection, ID allocator, pending registry, observers, and facade objects.
• Adds structured unknown-versus-malformed decode diagnostics with raw retention.
• Adds registry-backed private nested-union dispatch and fully types all 16 CodexErrorInfo discriminators.
• Establishes distinct ThreadItem / future ResponseItem direction while preserving using Item = ThreadItem.
• Migrates the existing exact 34 runtime identities without extending the intentionally partial A1.1 thread/turn model; the reviewed exact ratchet is now 50.
• Migrates BackendCore to client.typed() and preserves typed-but-A2-unmodeled events through the existing bounded extension path.
• Leaves Frontend Protocol v1/schema and codex-backend-client behavior unchanged; no BackendCommand/state semantics, remote operation, or SOVERSION change.

Final local validation at PR head

• GCC 15.3 Debug clean configure/build passed.
• ctest -N: 252 registered tests.
• Codex label: 81/81 passed; one established credential/quota-gated typed integration skipped.
• Full suite: 252/252 passed with that same gated skip.
• Staged installed consumer: 1/1 passed; both application targets build.
• Focused Clang 21.1.8: 13/13 passed.
• Focused ASan+UBSan with leak detection: 13/13 passed; vptr sanitization was deliberately excluded for the documented public-variant rebuild boundary.
• Raw non-credential real App Server handshake integration passed; credential/quota-gated typed integration was not claimed.
• Evidence, association, registry/docs, fixture regeneration/check/validation/mutation, source/binary package audits, and git diff --check passed.

Final CI: run 30032936320 / #315 completed successfully for cfc129ec879c70fc09c165035f6d1390f61289b8; job gcc-debug (89293671727) passed checkout, dependency installation, configure, build, tests, and cleanup.

This PR intentionally remains open and draft. It does not implement A1.1–A1.4, A2, A3, or Qt work, and Codex will not merge it.