fix(claude-code): harden concurrent action correlation

[adity982]

Summary

• validate Claude/hook completions against the pending action's stable session, call, tool, and turn identities before consuming the proposal
• preserve the legitimate pending action when a malformed or cross-wired completion arrives
• add adversarial interleaving coverage proving two identical tool calls with different turns settle independently and out of order

Validation

• focused HookSessionRuntime suite: 15 passed
• Claude Code + HookKit integration suites: 133 passed; one existing spawned-service test fails on this Windows host because its subprocess PATH is hard-coded to Unix paths
• Ruff format check: passed
• Ruff lint: passed
• git diff --check: passed
• mypy was unavailable in the active Python environment

The original cross-wired completion no longer removes the legitimate proposal; the regression test then settles both real completions successfully. Existing completions with engine-enriched tool input remain compatible because correlation uses only stable identity fields.

Closes #58

[SignalLayerLabs]

Thanks for your contribute, I only require you to fix the CI issue and then we are going to publish it on the repo

[adity982]

Fixed the CI issue on signed head fd89dad by regenerating the checked-in Codex runtime archive and provenance with the repository's scripts/build_codex_plugin.py. The branch source change had made that deterministic artifact stale.

Validation on the pushed head:

• scripts/build_codex_plugin.py --check: passed
• focused Claude correlation + runtime provenance tests: 16 passed
• Ruff format check: 214 files already formatted
• Ruff lint: passed
• git diff --check: passed

The broader local plugin slice had 24 passed / 1 skipped; three additional plugin subprocess tests hit Windows/Python 3.14-only timeout/access-violation behavior. The GitHub Linux matrix is the authoritative full-suite check and has restarted on this head.