[P1] Bound the Codex WebSocket transport and close resources on every failure

[ScriptedAlchemy]

Summary: Fix lifecycle and WebSocket framing in src/codex-bridge.js.
Why: upgrade/initialize failures leak sockets, fragmented text fails, handshake validation is weak, close leaves requests pending, and buffers/frames/messages are unbounded.
Acceptance criteria: one idempotent shutdown settling requests/timers; absolute deadlines; exact handshake validation; fragmentation/control-frame/UTF-8/opcode handling; header/frame/message/buffer budgets; fixtures for split, malformed, oversized, trickled, init-failure, pending, and repeated-close cases.

---

Parent: #24
Source: GPT-6 Pro post-land review of #27/#28 — https://chatgpt.com/c/6aa89f23-6920-83ea-b98a-a1f155a1ae3f

[ScriptedAlchemy]

Addressed via merged #40 + follow-up #43 (6 Pro hold then small fixes). Closing if acceptance is satisfied.