fix(codex): harden the 429 retry bound and contain unconfirmed stops

Follow-ups to the stalled 429 retry bound:

- Parse the HTTP-date form of Retry-After relative to the notice time.
- Treat a 429 named only in the error text as rate-limited when Codex
  reports no HTTP status; an explicit non-429 status still wins.
- Clear the pending deadline when the turn resumes into context
  compaction, and ignore late error notices after exhaustion.
- Interrupt the native turn, and every active descendant turn, before
  publishing the terminal. Descendants are re-scanned under the
  terminalization permit, so a nested turn started mid-teardown is
  either stopped or handled by the late-subagent path.
- When Codex does not acknowledge the interrupt within 10s, keep the
  turn active instead of reporting it idle. Fail it once Codex reports
  turn/completed, or after 60s, and mark the thread broken so the next
  turn resumes it instead of reusing a thread that may still be retrying.
  Subagent threads in that state are published as errored.
- Close a subagent's retry item with the rate-limit failure instead of
  the original transport error.
- Drive the retry tests from observable milestones and TestClock instead
  of yield loops and live timeouts.
7fa6a43d4dHong Liu committed on 10/22/2026, 7:49:36 PMparent719fde8
4 files changedLine totals unavailable