fix(auth): reconcile stale Codex pool snapshots

[cooper-oai]

Summary

Part 3 of 8. Depends on part 2.

• reject stale root and profile credential-pool snapshots
• preserve newer shared and independent manual rows during writes
• persist pool-only refresh rotations back to canonical state
• avoid restoring removed rows during compatibility paths and cleanup

Why

A stale process snapshot must not replay an old single-use refresh token or resurrect credentials another process removed.

This is a fork-local stacked draft. Promote it upstream after part 2 lands.

Validation

• focused suite at this layer: 416 passed, 2 skipped
• ruff, py_compile, Windows footgun scan, and git diff --check: clean

Stack

Priority order, highest to lowest:

1. NousResearch/hermes-agent#34820 — prevent Hermes Codex OAuth refresh-token reuse
2. cooper-oai/hermes-agent#1 — share canonical Codex state across profiles
3. cooper-oai/hermes-agent#2 — reconcile stale Codex pool snapshots
4. cooper-oai/hermes-agent#3 — migrate linked Codex aliases safely
5. cooper-oai/hermes-agent#4 — guard shared Codex store consumers
6. cooper-oai/hermes-agent#5 — quarantine Codex families by composite identity
7. cooper-oai/hermes-agent#6 — harden Codex migration and fallback routing
8. cooper-oai/hermes-agent#7 — avoid Codex refresh contention and fix guidance

Part 1 targets upstream main. Parts 2-8 are fork-local dependent drafts so each diff stays reviewable; promote each part upstream after the part below it lands.