fix: make Codex project roots writable

[pathscale]

Summary

• include the requested cwd as well as additional directories in Codex app-server workspace-write roots
• prioritize host controls over continuous app-server output so mid-turn steering and approvals are delivered promptly
• preserve Codex assistant-message boundaries so adjacent messages cannot glue prose to a Prompt Syntax directive
• add a real Codex regression proving a one-directory project can write inside its cwd
• bump agent-abstraction to 0.4.6 in an isolated final commit

Verification

• 191 library unit tests
• cargo fmt --all --check
• cargo clippy --all-targets -- -D warnings
• cargo test --doc
• cargo doc --no-deps
• clean cargo package build
• real codex_app_server_can_write_inside_its_cwd test
• real codex_app_server_accepts_a_live_steer test

The unfiltered local live-test binary also reports the pre-existing machine state that Claude is logged out and Codex account quota is unavailable. The two targeted Codex feature tests pass outside the task sandbox.