Add precision Codex runner probes

[KeyffMS]

Summary

Adds a second, precision diagnostic matrix for the remaining Codex CLI 0.152 runtime questions exposed by diagnostic run #14. It does not change C01-C16 capability results or the release gate.

Precision probes

• absolute external sidecars for PreToolUse, PreCompact/PostCompact, and SubagentStart; no git rev-parse inside hook recorders;
• real PreToolUse allow and deny controls for canonical Bash, including JSON and TOML hook representations;
• hooks-disabled negative control and trusted-project/no-bypass comparison;
• compaction single-step control plus forced two-step probes for body_after_prefix and total with TokenBudget disabled only inside disposable fixtures;
• SubagentStart comparison across ephemeral project agent, controlled non-ephemeral project agent, and controlled non-ephemeral isolated-home agent;
• per-run opaque context token known only to the SubagentStart hook; child instructions contain only the prefix/protocol, never the value;
• recursive token redaction from evidence;
• each variant is failure-isolated so one probe cannot abort the matrix artifact.

Workflow

Adds mode=precision to the already runner-allowlisted PlanAnvil Codex qualification workflow. Precision observations are diagnostic-only; the workflow gates only harness completion and artifact creation.

Safety

No runner policy changes, no privilege expansion, no raw transcript persistence, no release-gate weakening, and no product-contract changes in this PR.