fix(tribunal): recover Codex reviewer token usage

[SUaDtL]

Summary

• Recover cumulative reviewer usage from the exact Codex agent session.
• Record complete, partial, or unavailable actuals with a closed reason taxonomy.
• Bound and confine transcript parsing so malformed local state fails soft and cannot leak arbitrary text into telemetry.
• Correct the Codex host note to reflect current host-provided subagents.

Why

Codex dispatch results do not include usage, which left tribunal actuals blank. The best exact-thread source is local session telemetry, but its JSONL format is not stable. This isolates parsing behind a fail-soft helper and makes format drift explicit instead of silently reporting no actuals.

Verification

• python -m unittest plugins.ca.hooks.tests.test_codex_tribunal_usage -v (22 passed)
• Full hook suite under WSL (989 passed, 1 expected skip)
• All 25 .github/scripts/test_*.py suites
• python tools/build-surface.py --check
• python .github/scripts/check-plugin-refs.py
• Live exact-thread receipt recovery
• Independent coverage and security reviews: PASS

Tradeoff

The local session format is an unstable host detail. The helper treats it as best-effort, reads only metadata and cumulative usage events, applies strict bounds and path confinement, and returns fixed unavailable states instead of blocking the tribunal.

Closes #311

Issue #312 remains the separate follow-up for broader transcript recovery on the other host.

[SUaDtL]

Superseded by #313, the single hackathon review surface. This PR's recorded head and changes are represented in #313's exact 16-PR / 29-commit / 126-path source manifest. PR #313 passed final exact-head CI at commit 6173b1d and remains open and unmerged. Closing this source PR to avoid parallel review; please continue review and discussion on #313.