v2.14.0 — Codex external-reviewer integration + CC 2.1.206 compat

Optional Codex external-reviewer integration (/phx:review --codex,
/phx:codex-loop, /phx:watch-pr --codex), plus a CC 2.1.206 compatibility
pass: make the Stop hook actually reach the user, clean up StopFailure,
refresh model docs for Sonnet 5, and document the subagent nesting-depth budget.

Added

• Codex integration (optional) — use OpenAI Codex as an external reviewer
  when the codex CLI / Codex GitHub connector is available. Zero impact
  without it: every touchpoint is flag-gated and degrades gracefully.
  • /phx:review --codex — new codex-reviewer bridge agent (haiku) joins
    the review panel; issues flagged by both a Claude agent and codex are
    marked HIGH CONFIDENCE (cross-model consensus)
  • /phx:codex-loop — new skill: bounded review→fix→verify loop with the
    Codex CLI as external critic (default 3 rounds, --auto, Iron Law
    scrutiny on every finding)
  • /phx:watch-pr --codex — posts the @codex review trigger, watches
    reactions and reviews via new watcher events (codex_ack,
    codex_review, codex_clean, codex_timeout), and loops
    fix→re-request until codex + CI are clean (≤3 rounds). Skips the
    trigger when codex already auto-registered the PR on ready (bot 👀/👍
    on the PR body since the head commit — verified live); PR-level
    reactions are time-filtered so stale 👀/👍 from earlier rounds can't
    fire spurious events. Clean-pass bot COMMENTS ("Didn't find any major
    issues" + Reviewed commit: <sha>) classify as codex_clean instead
    of a generic comment event, and Reviewed commit sha comparison is
    the preferred freshness check (committer timestamps are client-set
    and can skew) — all from live-session analysis of 9 codex sessions
  • /phx:init Step 4b — managed ## Review guidelines block for
    AGENTS.md: one Elixir rubric honored by BOTH the local CLI review and
    the Codex cloud reviewer (verified live; the CLI rejects prompt +
    diff-flag combinations, so AGENTS.md is the only injection point)
  • pr-review bot-triage reference: codex thread anatomy (P1/P2/P3
    badges, per-commit reviews, clean-pass semantics)
  • Design note: a --codex-panel mode (3 dimension-focused codex passes
    alongside the holistic review) was A/B-tested on 4 real branches and
    rejected — real misses did not outnumber false positives on fresh
    diffs, at 4× quota cost. The single holistic review + AGENTS.md
    rubric is the shipped path; the A/B harness lives on as contributor
    tooling (.claude/skills/codex-ab/)

Changed

• Stop hook (check-pending-plans.sh) now reaches the user. A Stop hook's
  plain stdout goes to the debug log only (CC hooks ref), so the previous echo
  warnings were invisible in normal use. It now emits a JSON systemMessage
  (user-visible; Claude still stops), gated on the rare, session-created signals
  — running background_tasks[] / session_crons[] (a forgotten mix phx.server
  / scheduled job) — with pending plans + dirty tree folded in only as supporting
  context. Clean stops stay silent (no per-turn noise); pending plans and an
  uncommitted tree are already surfaced at SessionStart. Deliberately NOT
  additionalContext/exit 2, which would force Claude to continue every stop.
• CC changelog audit advanced v2.1.145 → v2.1.206 (48 versions). CLAUDE.md +
  README agent-model note updated: the sonnet alias now resolves to Sonnet 5 (CC's
  default model since 2.1.197, 1M context). Hook-output contributor notes updated
  for Stop (systemMessage vs additionalContext) and StopFailure (output
  ignored). Verified the Edit(*.ex) / Bash(*mix deps.*) hook if-conditions
  remain correct after the 2.1.176/2.1.163 matching changes (deps-audit-gate.sh
  self-guards; Edit(*.ts) is the canonical documented form).

Fixed

• StopFailure hook cleanup — CC ignores a StopFailure hook's exit code and
  output entirely, so stop-failure-log.sh's trailing exit 2 + stderr was a
  no-op that misled contributors into thinking it blocked/messaged. Removed; the
  scratchpad write (read by the next session's check-resume.sh) is the actual
  mechanism and is unchanged.
• /phx:brief showed no briefing content — with extended thinking
  enabled, the model composed each ★ Briefing section inside its (invisible)
  reasoning and went straight to the AskUserQuestion "Continue?" dialog, so
  the user saw only the continue prompts and never the brief itself. The
  skill and briefing-guide.md now require each section to be emitted as
  visible response text BEFORE the question (new Iron Law #7), and the
  question phrasing no longer implies the section was already shown. Same
  guard added to /phx:intro's section presentation loop and
  /phx:codex-loop's findings-triage step.