feat(capture): ingest codex session rollouts into review-gated session summaries

[plind-junior]

session auto-capture is claude-code-only today: .claude/settings.json hooks drive vouch capture observe (PostToolUse) and vouch capture finalize (SessionEnd), and src/vouch/capture.py rolls the observation buffer into one PENDING session-summary page proposal. codex has no equivalent live hook stream, so codex sessions leave no trace in the kb unless the agent proposes explicitly.

codex does persist every session as a rollout file (jsonl under ~/.codex/sessions/) containing user messages, tool calls, and outputs — everything summarize_tool/build_summary_body need, just after the fact instead of live.

proposed change

• new cli command, e.g. vouch capture ingest-codex [<rollout-file> | --latest]: parse one codex rollout jsonl, map tool-call records into the same observation shape capture.observe produces, then reuse the existing rollup (build_summary_body -> finalize -> propose_page) so the result is the same kind of PENDING proposal a claude session yields — one code path from observation to proposal, two front doors.
• put the rollout parsing behind a small dedicated parser with fixture files under tests/ — codex's rollout format is not a stable public contract, so schema drift must degrade to a clear error, not a stack trace.
• dedup guard: ingesting the same rollout twice must not create a second proposal (the session id in the rollout is the natural key).
• capture is a cli-side surface (hook-driven, not part of the kb.* method list), so the four-site registration rule doesn't apply — cli only, like capture observe/finalize.

review gate & scope

identical to existing capture: emits one page proposal via propose_page, never calls approve(). a human reviews it with vouch review like any other write. reads a local file the user names; no network.

acceptance criteria

• vouch capture ingest-codex <file> produces one PENDING session-summary page proposal from a fixture rollout
• --latest (or equivalent) resolves the newest rollout for the current project
• re-ingesting the same session is a no-op with a clear message
• malformed/unknown rollout schema -> actionable error, non-zero exit, nothing written
• the proposal and audit trail attribute the session to the codex actor (consistent with VOUCH_AGENT=codex used by the adapter)
• tests with checked-in fixture rollouts using placeholder data only (alice-example-style, no real paths/names)