fix(session): restore codex slash commands + recover dead resume anchors on the direct-CLI path

[BlackKeyZ]

Two session-layer fixes for the direct-CLI (session-port) stack, from Sentry user feedback:

1. codex in-session slash commands were gone (ELECTRON-3PX)

The port dropped the codex-acp bridge's private static command layer, so the in-session / menu advertised nothing and slash text was sent to codex as plain prompt text (codex does not interpret it).

• Advertise the bridge-parity 6-command table (/review, /review-branch, /review-commit, /init, /compact, /logout) through capabilities + CatalogUpdated, so the REST read, the frontend push, and the agent_metadata writeback all see it.
• Route slash prompts to the native ops the bridge used: review/start{target}, thread/compact/start, canned init prompt as a normal turn, account/logout (NoTurn + Notice). Unknown names and argument-less /review-branch|commit fall through verbatim (bridge parity).
• Also fixes a silent drop: a pre-filled agentMessage (review verdicts carry full text on item/started with no deltas) was discarded by the delta-only arm — the verdict never persisted.

Wire lifecycles live-verified on codex 0.144.1 (review/start, thread/compact/start); e2e: /review caught a planted bug and the verdict persisted.

2. A dead resume anchor hung codex forever / error-carded claude (ELECTRON-3Q0)

A conversation whose persisted resume anchor the CLI no longer knows (e.g. pre-port sessions after upgrade) failed every turn — cron manual triggers surfaced UNKNOWN_UPSTREAM_ERROR on claude, and codex left the turn permanently Running with the conversation locked. The existing dead-anchor self-heal fired but was structurally defeated: the auto-replay rebuilt the task from the frozen turn-start snapshot and re-resumed the same dead session.

• codex: claim the thread/resume response; on error ("no rollout found for thread id", live-captured) clear the pre-seeded binding and fail later sends fast as SessionNotFound instead of writing turn/start at a dead threadId.
• codex: an error response for a pending send is never silently dropped — turn-flavored requests synthesize an is_error terminal (single-terminal discipline preserved), /logout surfaces a Notice.
• A dispatch-time SessionNotFound clears the persisted anchor directly and classifies as the retryable UserAgentSessionNotFound.
• The auto-replay re-reads ONLY the resume anchor (session_id + snapshot) before attempt 2, so the mid-turn clear takes effect and the replay opens Fresh; turn-scoped fields stay frozen.
• Classifier: codex dead-thread messages are an agent-session error, not a provider-endpoint 404 (the generic "not found" arm was blocking the replay as non-retryable).
• Replay-safety gate: only Success tips count as visible output; Warning/Info tips are system diagnostics.

Live-verified end to end: with a planted dead anchor, a codex cron trigger now recovers transparently (attempt 2 opens a fresh thread, the reply persists, a real anchor rebinds — previously a permanent hang); claude replays Fresh and rebinds a new session id.

Full pre-push gate: 7442 tests passed.

[piorpua]

Added on top of this PR (commit 26f1246f): a second root-cause fix for ELECTRON-3Q0.

The dead-anchor recovery here handles a rejected thread/resume hang. But the cron failure has an earlier, independent trigger this PR doesn't reach:

• cron forces full-auto on every scheduled run = full_auto_mode_id(codex) = agent-full-access (aionui-common/enums.rs).
• codex's live catalog only advertises the legacy bare token full-access (:danger-full-access→full-access, see codex_conn fill_discovery / profile_id_to_legacy_value) — never the canonical agent-full-access.
• turn_orchestrator::apply_required_runtime_mode passed agent-full-access straight to set_config_option, hitting the "non-empty catalog missing value" arm → bad_request("mode 'agent-full-access' is not one of the available modes").
• That failure returns Failed in run_user_turn before the send (no replay), so the dead-anchor recovery never engages — surfaced as UNKNOWN_UPSTREAM_ERROR.

Fix: align the canonical id to the live catalog before apply, mirroring the AcpAgentManager reconcile path (normalize_requested_mode_for_available_values) — downgrade the canonical full-access id only when the live catalog lacks it but carries the legacy token. A catalog with no full-access tier leaves the value so set_config_option still REJECTs (never silently pick a weaker mode); non-codex backends and non-full-access modes pass through untouched.

Scope: covers the required_runtime_mode auto-apply path (the always-reproducing cron case). An interactive manual switch to full-access goes through the user's explicit set_config_option and is a related but separate gap — not included here; suggested as a follow-up.

Added 6 unit tests; cargo test -p aionui-conversation + clippy pass.

Note: the "codex advertises full-access via the legacy token" claim is grounded in the AionCore-side parsing (fill_discovery / profile_id_to_legacy_value), not re-confirmed against a codex 0.144.x wire capture (no local samples/codex-cli/).