Fix Cur session discovery and external-config imports

[shiny-code-bot]

Objective

Fix Cur session discovery for hyphenated/multi-segment project paths and restore dependent external-agent configuration imports.

Finish Line

Cur transcripts are discovered, grouped, filtered, and re-detected correctly under release-runner paths such as codex-ci-tmp; subagent transcripts remain excluded; app-server secondary-source import sees the expected session and plugin state.

Current Status

State: waiting behind the current #706 → #707 release sequence; no implementation stage has started.

Run 31973347222 has four direct codex-external-agent-migration failures plus external_agent_config_secondary_source_imports_session_and_plugin_end_to_end. All return empty discovery results on CI paths with multiple hyphen-separated components. The bounded resolver in codex-rs/external-agent-migration/src/detect/sessions/cur.rs:100 cannot reliably reconstruct those ancestors.

Next action when promoted by #703: reproduce the path-discovery cluster from the then-current immutable main, repair only the bounded Cur ancestor resolution, and verify both direct migration tests and the app-server secondary-source import path.

Acceptance Criteria

• Resolve common separators and multi-hyphen path components without unbounded candidate generation.
• Preserve ambiguity safeguards and subagent-transcript exclusion.
• Batch detection and modified-import re-detection remain correct.
• The dependent app-server secondary-source import passes end-to-end.
• Focused migration and app-server tests pass on macOS-like temporary paths.

Relationships

• Sub-issue of Restore lab.5 release Rust test convergence #703.
• Failure source: validation-only release run 31973347222.