Build auto-review durable lifecycle foundation

[shiny-code-bot]

Refs #130

Summary

• expand the durable auto-review store lifecycle vocabulary toward the authoritative Every Code model while preserving Codex Lab run ids, ReviewTarget, scoped store layout, and app-server/TUI contracts
• make runs.json the canonical store record and treat output sidecars as recovery/detail cache so corrupt or premature sidecars cannot override the index
• add tested helpers for duplicate lookup, stale-target filtering, fingerprint-scoped supersession, and lost-run reconciliation with live-run preservation

Validation

• cargo test -p codex-auto-review
• cargo test -p codex-core auto_review_awareness
• cargo test -p codex-core review_persistence
• cargo test -p codex-app-server review
• cargo fmt --manifest-path codex-rs/Cargo.toml --all --check
• git diff --check
• read-only diff review agent; repaired all reported lifecycle/scope issues before opening

Notes

This is the first #130 implementation slice. It deliberately does not wire the new store helpers into runtime scheduling yet, nor does it port review.lock / snapshot.epoch. Those remain the next slices after this foundation is reviewed.