feat(lastcode): add Codex thread tools - #52

## Problem

Codex can infer LastCode session identity by probing environment
variables and SQLite, but there is no supported, bounded way to
identify, list, or inspect threads—especially when composing the same
operation over SSH.

## Solution

- add `t3 thread current|list|read` with stable, bounded JSON output;
- materialize a home-pinned `lastcode-thread` wrapper and expose it only
to Codex processes on supported POSIX hosts;
- inject authoritative LastCode thread/home identity and preserve
Codex's provider-native thread identity in the session projection;
- use least-privilege authenticated live reads with a bounded offline
projection fallback;
- document explicit local-first/SSH composition without adding host
discovery, MCP, or a broker.

This PR is slice 1 of umbrella PR #52. It intentionally contains no
thread messaging or waiting behavior.

## Validation

- five bounded Luna-high review rounds; final correctness, KISS, and
best-practices results are clean;
- 231 focused tests passed;
- focused lint and server/contracts typechecks passed;
- repository pre-push quick CI passed: formatting, workspace typechecks,
and all workspace tests.

Implemented with GPT-5.6 Sol and reviewed with GPT-5.6 Luna in the Codex
harness.

## Problem

Codex can infer LastCode session identity by probing environment
variables and SQLite, but there is no supported, bounded way to
identify, list, or inspect threads—especially when composing the same
operation over SSH.

## Solution

- add `t3 thread current|list|read` with stable, bounded JSON output;
- materialize a home-pinned `lastcode-thread` wrapper and expose it only
to Codex processes on supported POSIX hosts;
- inject authoritative LastCode thread/home identity and preserve
Codex's provider-native thread identity in the session projection;
- use least-privilege authenticated live reads with a bounded offline
projection fallback;
- document explicit local-first/SSH composition without adding host
discovery, MCP, or a broker.

This PR is slice 1 of umbrella PR #52. It intentionally contains no
thread messaging or waiting behavior.

## Validation

- five bounded Luna-high review rounds; final correctness, KISS, and
best-practices results are clean;
- 231 focused tests passed;
- focused lint and server/contracts typechecks passed;
- repository pre-push quick CI passed: formatting, workspace typechecks,
and all workspace tests.

Implemented with GPT-5.6 Sol and reviewed with GPT-5.6 Luna in the Codex
harness.

## Problem

Codex can infer LastCode session identity by probing environment
variables and SQLite, but there is no supported, bounded way to
identify, list, or inspect threads—especially when composing the same
operation over SSH.

## Solution

- add `t3 thread current|list|read` with stable, bounded JSON output;
- materialize a home-pinned `lastcode-thread` wrapper and expose it only
to Codex processes on supported POSIX hosts;
- inject authoritative LastCode thread/home identity and preserve
Codex's provider-native thread identity in the session projection;
- use least-privilege authenticated live reads with a bounded offline
projection fallback;
- document explicit local-first/SSH composition without adding host
discovery, MCP, or a broker.

This PR is slice 1 of umbrella PR #52. It intentionally contains no
thread messaging or waiting behavior.

## Validation

- five bounded Luna-high review rounds; final correctness, KISS, and
best-practices results are clean;
- 231 focused tests passed;
- focused lint and server/contracts typechecks passed;
- repository pre-push quick CI passed: formatting, workspace typechecks,
and all workspace tests.

Implemented with GPT-5.6 Sol and reviewed with GPT-5.6 Luna in the Codex
harness.

Htulo needs one unattended LastCode update per day without password
prompts or repeated relaunches.

This adds one external 04:00 LaunchAgent controller. It stages and fully
prepares the newest Intel nightly at or below airy's installed version
before interrupting work, asks currently working htulo threads to pause
concurrently through the merged local thread CLI, checks once for
newcomers, quits once, swaps the user-owned app, attempts one launch,
and tells paused threads to resume. If any thread does not acknowledge,
the app stays running and already-paused threads are resumed.

The scheduled path never uses bootstrap mode. A one-time manual `run
--bootstrap` is documented for upgrading the currently installed pre-#52
app; after that, scheduled runs require the merged local thread wrapper.
Airy must have non-interactive SSH access enabled; otherwise staging
safely skips before changing pending state.

Focused validation: 25 controller/installer tests; scripts typecheck;
targeted lint, formatting, syntax, and diff checks. Normal pre-push
quick CI passed all workspaces.

Implemented with GPT-5.6 via the Codex harness.