fix(codex): honor run budgets and prevent false terminal success

[danhayman]

Summary

Fix Codex app-server turns being forcibly terminalized after a hardcoded 600 seconds and incorrectly returning interim assistant/progress text as successful final output.

The change:

• propagates the caller's monotonic run budget through the entire native app-server turn, including startup and turn/start;
• defines no-budget behavior without an arbitrary whole-turn cutoff;
• accepts missing-turn/completed compatibility only for protocol-grounded final_answer items, snapshotting canonical text so later commentary cannot replace it;
• returns explicit partial/error state and retires/interupts on real deadlines rather than promoting arbitrary text;
• preserves post-tool silence, explicit interrupt, process-death, provider-timeout, and session-retirement semantics;
• makes approval waits deadline/interrupt/process-death aware;
• prevents terminal pre-drain from authorizing a queued request;
• makes the real CLI approval modal cancellation-wakeable and guarantees cooperative worker/modal cleanup before return;
• keeps unknown non-cooperative third-party callbacks bounded.

Reproduction

Multiple native Codex app-server sessions launched with --run-budget 10800 or 14400 ended at exactly 600 seconds with:

codex app-server turn reached deadline after a completed assistant message but before turn/completed; accepting the assistant text as the terminal response

The accepted text was an interim progress message and the CLI exited code 0. The defect also reproduced while implementing this fix.

Related upstream context:

• [Bug]: Codex app-server can time out after completed assistant text #58432 reported missing turn/completed after assistant text.
• fix(codex): recover app-server text without completion #58433 was closed unmerged; equivalent permissive fallback later landed but covered only a single apparently-final message.
• feat(codex): make app-server timeouts configurable #79230 makes hardcoded timeouts configurable but does not propagate CLI run budget or prevent interim-text false success.

This PR addresses the combined deadline, event-classification, and approval-lifecycle bug class.

Verification

Final remediation and independent review evidence includes:

• 1,886 expanded approval/CLI/runtime tests passed; 8 Windows-only skipped.
• 460 transport/runtime tests passed during remediation.
• Independent review: 441/441 transport/runtime and 118/118 changed base-path tests passed.
• Terminal completed/interrupted/failed pre-drain cases: 5/5 passed.
• Real CLI process-death, interrupt, deadline, active-approval, late-response, lock-contention, and callback-reentrancy reproductions passed.
• Non-cooperative callback remained bounded at approximately 0.300 seconds.
• Ruff, py_compile, and git diff --check passed.
• Exact candidate independently reviewed and approved: 44c7ff3aafe37a28495ddf6d5f7afd57cda51688.

A broader unrelated test can be environment-sensitive when /tmp resolves inside a Git workspace; no failure implicated this diff.

Deployment

No live gateway was restarted or modified while developing or reviewing this change.