Classify expired Codex OAuth refresh diagnostics safely

[morningstarnasser]

Summary

• Classify three bounded, stable Codex OAuth invalidation/expired-refresh diagnostics as key_rejected.
• Keep arbitrary exit-1 output unknown, authentication fallback disabled, and raw diagnostics out of errors/events.
• Add three regression cases and update public collected-test counts to 3219, including the two count-only changes in CLAUDE.md.

No credentials, auth-store changes, kernel changes, dependency updates, release tags, or version bumps.

Verification

• Focused resilience/fallback/runtime-repair tests: 70 passed twice consecutively.
• Full macOS suite: 3217 passed, 2 skipped (3219 collected). Skips: no adjacent .venv; no private remote in public checkout.
• Adversarial suite: 263/263.
• Desktop boundary tests: 101 passed.
• Additional review probes: all three markers on both streams retain no synthetic secret/diagnostic in exceptions or events; out-of-bound diagnostic remains unknown.
• Public hygiene, embedded verifier pins, compile check, and git diff --check: passed.
• Gitleaks on this branch's pure diff: no leaks found (not a claim about historical commits).
• OSV on all five pinned dependency files: no issues found.
• Manual diff/security review completed; optional local-model review was unavailable and is not counted as passed.

Production instances and private checkouts are outside this change.