Let codex exec resume runs by session UUID

[lox]

I've been bouncing between #3712 and #3187 trying to understand why automation runs kept stalling out, and it finally clicked that the real blocker is tracked in #3817: once codex exec finishes, there’s no ergonomic way to pick the session back up.

This PR teaches both the headless CLI and the shared proto entrypoint how to resume cleanly. --session <UUID> now accepts the conversation identifier that we print in the banner, discovers the matching rollout on disk, and wires it through as the experimental_resume override.

For folks who already know the rollout path, --resume-rollout <FILE> skips the lookup and normalizes the path for them. While I was in there I made sure the JSON-mode SessionConfigured event echoes the rollout location, and I updated the docs so the happy path is obvious.

This should fix both codex exec usage and codex mcp conversation resuming, so closes #3712 amd #3817 🎉 Exec usage looks like:

# Non-interactive exec
codex exec --session 7f7116f0-a04f-4a8b-b994-a4ce80ac2875 "continue the deployment"
codex exec --resume-rollout ~/.codex/sessions/.../rollout-...jsonl "review the last turn"

I did my best to follow the contributing guidelines!

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[lox]

I have read the CLA Document and I hereby sign the CLA

[lox]

I'll rebase this onto the new commands.

[lox]

Going to start fresh on the most recent changes.