Fix managed Codex test snapshots reading executable symlinks

[lilly-luo]

Codex managed-policy tests repeatedly lose their runner at case 06. Their preservation check follows four disposable .codex/tmp/arg0 symlinks to the 263 MB Codex executable, retaining about 1 GB per snapshot. The mandatory version probe rotates those paths before ug rejects the override, making pytest attempt an enormous binary comparison.

This change fingerprints regular files with streamed SHA-256, records symlink targets without following them, and excludes only the fetched managed-config cache and disposable Codex bootstrap directory. Persistent configuration additions, changes, and deletions remain failures, reported by path. All 19 managed Codex cases stay enabled; cases 06, 08, 10, and 12 share the repaired helper.

Managed CI also gets a five-minute per-case deadline with an earlier stack dump, a twenty-minute suite deadline below the existing thirty-minute job limit, phase timings, and peak-memory reporting. The required CI structure is unchanged.

Validation:

• CI attempt 1: complete workflow passed. Managed Codex: 19 tests, 0 failures, 0 errors, 0 skips in 192.23 seconds; peak resident memory 421,788 KiB. Managed Claude: 23 passed.
• CI attempt 2: managed Codex passed again on a fresh runner, all 19 tests with 0 skips in 203.74 seconds; peak resident memory 428,380 KiB. Required gates passed.
• Minimal alternative #762 proves that excluding .codex/tmp/arg0 alone is sufficient for the current failure: all 19 tests passed in 181.17 seconds, without changing hashing, assertions, timeouts, or CI. This PR adds safeguards against other large files and future hangs.
• 16 focused snapshot, integration-contract, and runner-argument checks pass on Python 3.12. The memory regression snapshots a 16 MiB file using under 1 MiB of traced allocations.
• A real Codex 0.154.0 probe confirmed four rotating helper symlinks representing 1,051,432,064 bytes per old snapshot; the new persistent snapshot remains equal across version checks.

The broader local suite passed 2,495 tests with six skips and three environment-dependent Codex failures. The two model-selection failures reproduce on unchanged main; the third uses the developer machine's Codex settings instead of the test capture endpoint. The fresh CI unit job passed. Host-level OOM as the original shutdown mechanism remains unconfirmed.