feat(codex): add opt-in retained app-server processes

[dviejokfs]

Change

Opt-in Codex app-server retention lets consecutive turns in an acquired runtime reuse one native process. Default SDK behavior remains process-per-turn; custom executors keep their existing default hooks. Applications opt in with CodexProcessRetention and explicitly register Codex::app_server().

The pool is bounded, expires idle processes, and cold-runs new conversations when full. Configuration changes transfer the reserved slot to a replacement process. Cancellation, timeout, protocol failure, disposal, and abandoned turns retire the affected process. Turn correlation prevents stale events from reaching a later invocation; unsolicited idle output retires the connection.

Validation

• Full suite: 322 passed, 1 ignored; focused Codex suite: 20 passed.
• cargo check --no-default-features and all-target/all-feature Clippy with warnings denied passed.
• Independent correctness review: all reported lifecycle, framing, capacity and cleanup findings resolved.
• Fleet bridge: 32 tests passed, 2 existing opt-in tests ignored.
• Live isolated Fleet Dev: an existing pre-upgrade conversation continued with the same provider session; successive turns reused native PID 54171. Permission changes replaced the process, idle expiry terminated it, and later turns resumed context correctly.
• Restarting Fleet Dev with the flag absent continued the same conversation and restored process-per-turn exit behavior.

First-text samples were 7.374 seconds cold and 6.109 seconds warm. These are diagnostic samples, not a latency benchmark; PID reuse establishes retention. Claude and OpenCode process retention are outside this change.