[codex] enforce Console activity logging

[ape-rture]

Summary

• add --require-console-log and INDEXING_CO_REQUIRE_CONSOLE_LOG for activity-producing CLI commands
• preflight strict mode before mutations when no Console session is active
• fail strict mode when neither the supplemental activity write nor the server-side Console rail event is visible
• accept strict mode when the API/server has already produced the matching rail event, avoiding false failures and duplicate lifecycle noise
• mark existing domain-event commands as activity-producing so the rail stays concise

Verification

• npm test
• npm run lint
• git diff --check
• GitHub Actions CI passed for Node 18, 20, and 22

Live smoke

Fresh naive agent cloned the pushed branch at 9c995fb and built it from scratch.

Prod Console:

• session: 019ed51c-9240-7aa2-9d40-9466f794d401
• filter: cor_1858_strict_prod_v2_20260617164007
• strict create/add/remove all exited 0 with empty stderr
• agent doctor connected true and found 3 matching rail events
• browser rail showed Created filter + two Updated filter cards, 16 events total

Staging Console:

• session: 019e8efe-7962-7f6c-a7d5-71e458028ed8
• filter: cor_1858_strict_staging_v2_20260617164033
• used repo-documented/default API base https://app.indexing.co/dw because no staging API env was configured
• strict create/add/remove all exited 0 with empty stderr
• agent doctor connected true and found 3 matching rail events
• browser rail showed Created filter + two Updated filter cards, 6 events total

No live block tests, deploys, or backfills were run.