fix(codex): idempotent session-end under Stop collapse

[SethGammon]

Summary

Prevent session-end.js from firing on every turn-stop in Codex.

In Claude Code, SessionEnd fires once at session close. In Codex, the bridge maps SessionEnd → Stop because Codex has no native SessionEnd event, so without a guard the hook would re-run on every turn — re-logging cost, re-incrementing trust counters, re-marking campaign continuation, re-appending to the daemon log.

This adds a session_id-keyed marker at .planning/telemetry/session-end.lock. The hook checks it at the top of main() and exits early if the current session has already fired.

The guard is keyed on session_id, not runtime, so:

• In Claude Code it's a no-op (SessionEnd only fires once per session anyway).
• In Codex it suppresses duplicate fires under the Stop collapse.
• If Codex eventually ships a real SessionEnd event, the same code keeps working without changes.

Context

This is the last of the bridge-hardening fixes I worked on this session. The other four (install-hooks-codex --verbose/--json, full-tree skill copy, full-schema MCP translation, observable agent truncation) are already on main — they were swept up into PR #115's squash-merge from earlier branch contamination, so the squash commit body lists their original messages even though the PR title doesn't. This PR contains only the session-end fix because that's all that wasn't already shipped.

Test plan

• node scripts/test-all.js — 20/20 PASS
• node hooks_src/smoke-test.js — PASS
• Manual: simulating two consecutive Stop events with the same session_id, the second exits early before any state mutation