Use live Codex auth for compaction and project C13 fallback

[KeyffMS]

Summary

Apply the final findings from full qualification run 33879462583 without weakening product contracts or release gating.

C08/C09

• use the runner's real CODEX_HOME so Codex can refresh the live auth state during long full runs;
• persist project trust only in config.toml for the duration of the targeted capability and restore that file byte-for-byte afterwards;
• keep trust_project=False and remove --ignore-user-config, so Codex 0.152 reads persisted trust instead of an invalid CLI project override;
• do not alter auth/session files as part of the trust bridge.

C13

• keep ephemeral first and keep the recognized parent-thread failure as the only fallback trigger;
• replace the previous home-agent fallback with a non-ephemeral project-agent + project-scoped SubagentStart hook fallback;
• explicitly declare [agents.fixture_agent] in the project config, while using an isolated trusted CODEX_HOME only for persistence/auth isolation;
• keep repository, session cleanup, auth fingerprint, exact agent_type, additionalContext, and continue=false assertions unchanged.

Regression protection

• add v7 tests for live-home config restoration, absence of --ignore-user-config, exact project role declaration, project-scoped C13 fallback, workflow routing, and safety boundaries;
• the approved qualification workflow now calls live_codex_qualification_harness_v7.py for full/c13 only;
• C01-C16 gate semantics, product hooks, sandbox policy, approval policy, and TokenBudget behavior are unchanged.