[codex] Harden starter workflow defaults

[jvogan]

Summary

• Narrow generated Codex worker environment to LINEAR_API_KEY instead of inheriting the full shell environment.
• Add explicit campaign closeout metadata to generated workflows and document the trusted Linear queue boundary.
• Extend preflight checks for campaign metadata, routing alignment, env policy, full-access routing, overlap guidance, and unsafe concurrent snapshot promotion.

Validation

• python3 -m py_compile skills/symphony-linear-orchestrator/scripts/*.py
• git diff --check
• Generated a temporary bootstrapped workflow, parsed its YAML, and ran preflight.py --json with 0 warnings/failures.
• Verified the new snapshot-promotion check fails a concurrent workflow using snapshot-promote in after_run.