pin rollout references by segment

[friel-openai]

Summary

Pins rollout references to a specific rollout-storage SegmentId.

ThreadId remains the runtime identity for sessions, app-server operations, TUI routing, state DB rows, model headers, and user-facing APIs. SegmentId is only used to resolve a specific rollout JSONL segment. ForkReference now records { thread_id, segment_id }, so references remain durable if a session later writes another rollout segment or the old segment is archived.

This PR also keeps current compaction cleanup behavior: duplicate contiguous user messages are dropped during compaction, and unified exec max-process warning messages are filtered by prefix instead of using the old exclude_from_compaction behavior.

This PR does not change default feature flags or release workflow behavior.

Validation

• cargo test -p codex-rollout
• CODEX_SKIP_VENDORED_BWRAP=1 cargo test -p codex-core thread_rollout_truncation -- --nocapture
• cargo test -p codex-app-server-protocol
• CODEX_SKIP_VENDORED_BWRAP=1 cargo build -p codex-cli --bin codex