Add controlled C13 transport diagnostic

[KeyffMS]

Summary

Implements the first resolution step for #17 without changing baseline 2.2 or weakening the full release gate.

C13 semantic probe

• replaces the old fixed context token with an outer-generated opaque proof that is not present in the root-agent prompt;
• exercises one real project-scoped SubagentStart hook and one real configured fixture_agent;
• records only structural hook facts (continue=false, presence of additionalContext, event count);
• requires the child to echo the unseen injected proof, so C13 cannot pass from prompt knowledge or documentation alone;
• classifies a reached-but-wrong hook/child semantic result as FAILED and a transport failure before the semantic boundary as BLOCKED.

Ephemeral-first transport diagnostic

• keeps codex exec --ephemeral as the first attempt;
• recognizes only the known collab spawn failed: no thread with id parent-thread registration failure as eligible for fallback;
• adds workflow_dispatch mode c13 for the controlled comparison;
• full remains strict-ephemeral and cannot enable the non-ephemeral fallback until a later baseline 2.3 decision.

Controlled non-ephemeral fallback

• available only in mode=c13 / --only C13 diagnostic execution;
• preserves approval=never, read-only sandbox, trusted disposable project and model-tool network disabled;
• creates a private disposable CODEX_HOME;
• does not read or copy auth.json; when file-backed auth exists it uses a temporary symlink to the existing file;
• redirects SQLite/log state into the disposable home and sets history.persistence="none";
• records only rollout count, verifies auth metadata is unchanged, removes the entire disposable home and fails closed if cleanup cannot be proven.

Scope

• relates to Analyze C13 SubagentStart assumptions under codex exec --ephemeral #17;
• baseline 2.2 is unchanged;
• C13 fallback is not yet enabled in full;
• no production PlanAnvil core changes;
• no sandbox/approval bypass flags;
• this PR uses only ordinary GitHub-hosted CI.

After this merges, run PlanAnvil Codex qualification from main with mode=c13. A successful diagnostic will provide the evidence needed for the follow-up baseline 2.3/full-integration PR.