tests: add live Codex probe coverage

[gaelic-ghost]

Summary

• closes the stale v1 audit/roadmap drift now that v1.0.1 is shipped
• adds an opt-in live Codex behavior matrix for approval policy, sandbox, history, same-thread, and CLI diagnostics probes
• adds an opt-in server-request family coverage report and wrapper script, with live command/permissions coverage and explicit blockers for tool user input and MCP elicitation live reproducers

Remaining gaps

• Tool user input still needs a reliable current mock Responses reproducer for item/tool/requestUserInput.
• MCP elicitation still needs a local MCP server fixture that deterministically requests elicitation during a live turn.

Verification

• swift test
• git diff --check
• bash scripts/repo-maintenance/validate-all.sh
• scripts/run-live-codex-behavior-matrix.sh
• scripts/run-live-codex-server-request-probes.sh