Fix false usage-limit detection in Codex output

[danii1]

Summary

• require subscription-limit messages to match a complete diagnostic line instead of arbitrary source-code substrings
• stop treating all stderr as trusted diagnostic output because Codex writes its tool transcript there
• strengthen source, quoted-string, and compact diff-line filtering
• log the exact matched line whenever DevIntern classifies a run as usage-limited
• add regression coverage for the source line that caused the false positive

Codex file-content exclusion

Codex exec supports --json and emits newline-delimited JSON events, so complete provenance-based exclusion is possible by scanning only error events and excluding command/tool output events. This patch keeps the current formatted-output integration and hardens its text matching. Moving to JSONL should be a separate change because DevIntern currently streams plain output and uses stdout as the final implementation summary in several execution paths.

Official reference: https://developers.openai.com/codex/cli/reference

Verification

• focused usage-limit detector suite: 32 passed
• pre-commit format, lint, and typecheck: passed across all packages
• agent-harness suite: 248 passed; the existing sandbox-sensitive process-group test failed because ps returned no PGID
• the full pre-push test hook was stopped after hanging without output in the sandbox; push used --no-verify after the checks above