fix(codex): recover legacy thread names

[huzhongyyuan]

Explicit opt-in repair redesign is in commit 7eee7ad. See the latest comment for safety details.

[huzhongyyuan]

Thanks for pointing out that automatic startup migration was not appropriate. I redesigned the PR as an explicit opt-in command: cc-switch sessions repair-codex-names. It is dry-run by default, and only --apply writes changes.\n\nThe command strictly backfills only history_mode = paginated rows whose threads.name is NULL or empty, using non-empty thread_name values from session_index.jsonl. Existing non-empty names are never changed or cleared. Archive state and provider fields remain untouched, and the old startup automatic migration has been removed.\n\nThe redesign also removes the repair ledger and all ambiguous ownership/ABA paths. It adds immutable dry-run handling, WAL/SHM/journal protection, bounded config/index/database work, index-plan validation, pre-write SQLite backups, conditional updates, and post-commit identity/source checks.\n\nValidation passed: cargo check, cargo fmt --check, three focused Codex repair tests, two CLI parser tests, and git diff --check. The updated commit is 7eee7adf. Please review this redesigned explicit-command version again. If you prefer an even smaller PR scope, I am happy to adjust it.