Guarantee startup message delivery

[Time4Mind]

Problem

Messages received after pressing Start could be routed before the new Codex session was actually ready. Voice, text, photos, documents, and commands could therefore be lost or land in the previous session.

Fix

• capture every inbound update in a per-user FIFO from the beginning of the new-session flow
• stop queued updates from leaking into the previous active session
• keep the startup gate closed until a real Codex input screen is detected
• replay only after the new tmux window is bound and ready
• require transcript acknowledgement for normal prompts and retain the queue head on failure
• handle Codex update/trust startup screens safely
• preserve provisional session state until the session map appears

Verification

• ruff check src tests
• pytest -q: 1001 passed
• targeted pyright: 0 errors
• isolated live tmux/Codex probe: two FIFO prompts delivered and observed exactly once in the transcript