fix: bind provider resumes to persisted sessions

[numnx]

What changed

• Make the current codex exec --json thread.started event authoritative for the persisted native session id.
• Read Codex telemetry from rollout-*-<native-thread-id>.jsonl in the paired runtime volume instead of the newest rollout file.
• Select Task QA continuation invocations across logical and durable workspace session ids, preferring the invocation linked to the workspace-binding task run for every CLI provider.
• Keep the one-time fresh-session QA fallback only for legacy or already-corrupt Codex records.
• Prevent Antigravity logical/workspace ids from being passed as native --conversation ids; use workspace-local --continue when no native id was captured.
• Update canonical and published orchestration/QA documentation.

Root cause and provider audit

The high-concurrency telemetry optimization switched Codex rollout collection to an incremental "latest file" reader. In a reused runtime home, an unrelated rollout could win identity precedence over the current invocation own thread.started event. Task QA also resolved the native coding invocation by logical session while resolving the runtime volume independently by durable workspace identity. Together, those paths could pass a native thread id to a runtime home that did not contain its rollout even though provider state persistence remained enabled.

The newest-file identity regression is Codex-specific. Claude Code reads an exact generated session file, OpenCode derives the exact session from the current event stream, Gemini and Qwen use project-scoped latest-session continuation inside the isolated paired runtime home, Antigravity derives its conversation id from its own per-invocation log, and Jules uses its hosted API session id. The QA workspace-binding repair is provider-agnostic. The audit also found and fixed the separate Antigravity logical-id fallback hazard described above.

Validation

• pnpm run ci for the Codex root fix
• pnpm run lint after the provider audit
• pnpm run test:backend after the provider audit: 6,167 passed, 12 skipped
• focused provider/QA regression suite: 183 passed
• pnpm run build after the provider audit
• dependency audit passed with no known high-severity vulnerabilities

Risk and rollback

Risk is limited to provider session identity/discovery and Task QA continuation selection. Legacy newest-rollout readers remain available only for callers without a Codex native id, and the bounded QA fallback remains available for already-corrupt records. Antigravity still uses an exact native conversation id whenever one is available. Roll back by reverting this PR; no database migration or persisted data rewrite is involved.