feat: native Codex dispatcher transport with attachable loopback endpoint (#86)

[lukemaj]

Closes #86.

Outcome: T3 Code can inspect and message the real live Codex dispatcher through Codex native app-server while Model Router retains routing, envelope handling, and process ownership.

Transport: one job-owned codex app-server on ws://127.0.0.1:PORT serves dispatch and all resume turns. Stable driver argv; op/model/effort/prompt in invocation meta. Native thread/turn ids authoritative. Second native client attaches metadata-only (thread/resume excludeTurns, no settings change), observes, steers via turn/steer, disconnects/reconnects without terminating the dispatcher or changing permissions. Side communication never becomes a routing envelope (control-turn filtered conversion). Cancellation, recovery, ownership (PID start identity), usage, capacity, one-writer, and exact cleanup preserved. Loopback only, no persistent host service, no Router inbox/chat API, no routing-policy change.

Reconciliation with main be2eca7 (#88 no-kill, #75 runtime, #87 recovery): status_view publishes native runtime on the job record alongside installed/assessment; runtime_missing checks use the full native turn meta so the action identity matches; test_runtime75 updated to the native seam (fake app-server branch, stored-meta keys, per-test plans).

Proof:

• python3 scripts/test.py: 712 tests OK, 1 skipped (full suite).
• python3 -m compileall -q runner scripts tests: OK.
• versionctl release-check: v0.32.0 at 2499ad3 OK.
• Live (codex-cli 0.156.1, loopback only, sanitized prefixes): two-client observe + disconnect/reconnect probe and steer probe both show the answer on dispatcher and observer; owned server stopped. Full thread/turn ids never published. Final fleet proof remains Fleet pane: inspect and message native agents across machines chromeria#1.

[lukemaj]

Closing with #86: since #116 (PR #119, v0.35.0) the dispatcher runs as a T3 thread, so T3 already shows it and lets the user and agents message it. A separate native Codex app-server transport is no longer needed.