## Summary

The E2E run on #620
([run](https://github.com/agentclientprotocol/codex-acp/actions/runs/38395294465))
failed on two model-dependent tests. #620 didn't cause it: the run
before it shows the same behavior and passed only by luck. This PR
changes test code only.

- **Default e2e model `gpt-5.2` → `gpt-6-luna[low]`.** `gpt-5.2` isn't
in the Codex model list anymore, so Codex used fallback metadata. In
0.160.1 that has `apply_patch_tool_type: None`, so the model ran
`apply_patch` through the shell. A malformed patch came in as an
`execute` approval, not `edit`, and broke `applies an approved workspace
file edit`.
- **Shell approval prompts ask for elevated permissions on the first
try.** In read-only mode the model sometimes ran the command in the
sandbox, hit `Read-only file system`, and ended the turn without asking
for approval (`cancels every command when cancel is selected` got
`end_turn`). This applies only to the tests that expect an approval
prompt.
- **Cancellation test follows how Codex handles interrupts.**
`gpt-6-luna` runs commands through unified exec, and `turn/interrupt`
doesn't kill those processes: they keep running as background terminals.
The test now:
  - waits until the client has seen the command's tool call;
- cancels and asserts the turn is `cancelled` and the process is still
running;
- stops the process with `_session/async_task/stop` and asserts it
exits.

The ACP SDK client rejects the `async_task_spawned` update because its
schema doesn't include it, so the test uses the tool call id as the task
id. For a root command they're the same.
- Fixture helpers: the fixture records tool calls, and
`createAuthenticatedFixture` can declare AIR capabilities.

## Test plan

- [x] `npx tsc --noEmit`
- [x] E2E workflow on this branch: [run
38406199843](https://github.com/agentclientprotocol/codex-acp/actions/runs/38406199843).
33 passed, 2 skipped. One retry, in the exec-policy amendment test: the
model mistyped the long temp path, so the saved approval rule didn't
match.