## Summary

First independent extraction from #655. This PR targets `main` directly
and does not depend on the standard-subagent implementation or any other
extraction.

- Raise the minimum ACP SDK patch from `~2.0.0` to `~2.0.2`.
- Update only the SDK's lockfile version, URL, and integrity. No other
dependencies or adapter source files change.
- SDK 2.0.1/2.0.2 include HTTP stream-conflict isolation, CR-only SSE
line-ending support, and request-scoped POST failure handling. This
adapter's existing stdio behavior is checked against the new package; no
HTTP-specific adapter changes or new subagent behavior are included.

## Validation

Run on this branch based directly on `main` at `a77829f`, without #655's
test configuration or runtime changes:

- `npm ci --ignore-scripts`: SDK resolves to 2.0.2; Codex remains
0.164.0 and Vitest remains 5.0.5.
- `npm run typecheck`
- `npm test`: **1,879 passed**, 36 skipped
- `npm run test:integration`: **7 passed**, using the real Codex
app-server with a local mock model
- `npm run build`
- `npm run bundle:all`: all six targets compile
- `git diff --check`

The full live-model E2E suite, direct HTTP transport tests, and
execution of every cross-platform bundle were not run. The existing five
npm audit findings are outside this dependency-only extraction.

## Split plan

This can be reviewed and merged independently. #655 stays open as the
reference implementation; subsequent changes will be extracted into
separate, independently validated PRs rather than landing that
monolithic diff.