fix(codex): restore hook and feature state exactly

[levineam]

Summary

• replace whole-file Codex config backup/restore with one semantic app-server transaction
• bind a mode-0600 v4 receipt to the exact profile and canonical config, recording owned key values and original parent-table presence
• recover pending/active receipt transactions after interruption
• remove only originally absent parent tables when they are empty after owned-key rollback
• keep hook, MCP, and provider rollback phases independent
• update runtime-kit validation, fixtures, package documentation, and regression coverage

Safety boundary

• every write targets the exact Codex user layer with canonical filePath and expectedVersion
• concurrent changes cause fail-closed preservation; unrelated sibling keys are retained
• changed, corrupt, ambiguous, or unavailable ownership state is preserved for reconciliation
• any legacy hooks.json is left untouched and blocks forward setup pending an explicit semantic migration
• this PR is intentionally stacked on draft PR fix(codex): make MCP rollback exact and gate CE by version #255 and should not merge before it

Verification

• full npm test: passed, including runtime-kit 261/261 and repository smoke checks 66/66
• agent-context focused suite: 82/82
• package dry run: 444 entries; setup and all three receipt/transaction helpers included
• real Codex 0.146.0, disposable byte-empty profile: setup x2 and rollback x2 exited 0, restored exact SHA-256 e3b0c442..., and cleared receipts/lock
• real Codex 0.146.0 concurrent-key canary: unrelated keys under hooks, features, shell policy, and shell-policy set were preserved
• current Codex 0.144.5 managed-provider canary: refused before mutation because conformance covers 0.146.0; disposable and active profiles were unchanged
• independent Terra review of exact head: no P0-P2 findings; deliberate legacy-file fail-closed behavior noted as P3 operational tradeoff

Activation status

Draft only. This PR does not authorize merge, install, activation, vault writes, OpenClaw/Paperclip startup, or background services. MacBook activation remains gated on stable merged source, the Mac Mini inventory/handoff, and an explicit Codex-version decision.

[levineam]

HOLD — retain as draft and do not merge or activate from this branch. It requires a dedicated issue plus a fresh review against the current Codex configuration surface and the Mac Mini compatibility inventory. Coordination: levineam/clawd#1249.