Isolate Codex 0.152 runtime contracts and declare PlanAnvil roles

[KeyffMS]

Summary

Consolidates the next Codex CLI 0.152 qualification step without changing the release gate.

Product

• explicitly declares plan_anvil_profiler and plan_anvil_reviewer in .codex/config.toml using the 0.152 [agents.<role>] contract and their existing role files;
• keeps the existing project hook definitions unchanged because exact 0.152 source confirms the current hooks.json shape and Bash matcher are valid.

Precision v2

Replaces the workflow's precision runner with a runtime-isolation matrix that separates previously-confounded variables:

• CLI trust + ephemeral project hook control;
• persisted project trust + non-ephemeral JSON and TOML project hooks;
• isolated-home hook control;
• SessionStart plus real PreToolUse deny, so hook discovery is distinguishable from matcher/dispatch failure;
• isolated-home compaction hooks with SessionStart control and single/two-step body_after_prefix/total variants;
• project agent autodiscovery vs explicit [agents.fixture_agent] vs isolated-home explicit role;
• non-ephemeral vs ephemeral subagent transport with the same home-scoped SubagentStart recorder;
• strict config parsing, isolated CODEX_HOME, auth fingerprint checks, cleanup, opaque context-token redaction, and no raw transcript persistence.

Regression protection

• keeps the old precision harness for reproducibility;
• adds dedicated v2 unit tests and updates the approved workflow test;
• precision remains diagnostic-only and cannot change C01-C16 release status.