fix(codex): make MCP rollback exact and gate CE by version

[levineam]

Summary

• make Codex MCP rollback receipt-bound and race-safe through a versioned app-server CAS
• preserve pre-existing, changed, concurrent, higher-layer, or inconclusively inspected jarvos registrations
• treat okOverridden as a committed user-layer deletion while preserving the higher-priority effective registration
• continue independent MCP, hook, and Compound Engineering rollback phases after another phase fails
• gate managed Compound Engineering activation on the exact reviewed Codex CLI version before setup writes
• keep exact whole-profile hook/feature restoration and stable-runtime publication explicitly out of scope

Ownership boundary

The owner-only receipt stores only a normalized fingerprint and bounded lifecycle state. It does not store raw MCP configuration or credentials. Rollback reads the exact user layer, verifies the recorded fingerprint, and submits config/batchWrite with the matching filePath and expectedVersion. There is no name-only removal fallback. A CAS conflict, unavailable prerequisite, changed value, or inconclusive result preserves the registration and receipt for manual reconciliation.

Successful ok and okOverridden responses both clear the obsolete user-layer receipt. A higher-priority effective registration and any concurrent post-CAS re-add remain untouched.

This PR does not authorize active-profile installation. Hook trust, exact feature/hook restoration, stable publication, and the Mac Mini compatibility audit remain separate gates.

Verification

• full npm test passed on exact head 60ce30d
• focused agent-context/work-action/runtime suite passed 132/132
• package dry run includes the Codex setup, README, and MCP receipt helper
• real disposable Codex 0.146.0 setup/rollback passed through app-server CAS
• live Codex 0.144.5 admission refused before jarvOS-managed profile writes
• git diff --check and shell syntax checks passed
• independent Terra/high and Sol/high review of the identical delta: no P0-P2 findings

Addresses #254.