fix(codex): harden websocket API-error recovery

[yxlyx]

What changed

• Retire a Codex WebSocket immediately after a terminal type:error frame while preserving a one-request marker for bounded downstream diagnostics.
• Re-anchor only when the rejected request body actually contained previous_response_id; retained chain state alone no longer triggers an unchanged full-input retry.
• Route malformed Responses bodies through the bounded provider diagnostic path instead of copying raw envelope bytes into last_api_error.
• Strengthen focused coverage for socket retirement, transport-ladder accounting, stale-chain request gating, and diagnostic redaction.

Why

Problem / failure mode

The initial #692 fix correctly treats generic WebSocket error frames as API responses, but three edge paths remained. The lower-level transport retained a dead socket until the parser ran, stale-chain recovery consulted session state even when the serialized request had deliberately omitted previous_response_id, and malformed response bodies bypassed the redaction boundary.

Reason for this approach

A short-lived marker separates transport cleanup from later error formatting, so the socket can be closed immediately without losing the structured diagnostic. Recovery now follows the rejected wire body rather than stale in-memory state, which preserves the safe one-shot re-anchor while avoiding deterministic retries. Unparseable bodies use the same bounded diagnostic formatter as structured provider failures.

Constraints and trade-offs

Raw malformed envelopes are intentionally omitted because they can contain echoed request or authentication-adjacent data. The trace still records request and response sizes for diagnosis. Generic errors remain terminal; only recognized chain errors on requests that actually used the chain can rebuild.

Rejected alternatives

Leaving the dead socket as a sentinel was rejected because lower-level callers could reuse it before parser cleanup. Checking only codex_prev_id was rejected because full-resend and property-change paths retain that state while emitting full input.

Verification

• scripts/eval-tier1.sh
• python3 scripts/test-pty-codex-ws.py ./zig-out/bin/graff
• Focused parser/redaction, immediate-close, stale-chain, fullscreen TUI, and compaction-shape edge cases

Fixes #692