Codex notify path: fragile session matching (no session_id / cwd)

[huiyu]

Codex delivers the "needs you" (approval-requested) signal only to the `notify` program as argv JSON, which carries no session_id and no cwd (openai/codex#4005). agentdeck currently matches it to the newest Codex session in that directory (`lib/core.sh` `_ingest_notify` / `lib/agents/codex.sh`).

Problem

• With multiple concurrent Codex sessions in the same directory, the waiting signal can be attributed to the wrong session.
• Working / idle states (via hooks) are exact; only this notify-sourced "waiting" state is heuristic.

Possible directions

• Track upstream JSON passed to notify app should include cwd or full environment_context openai/codex#4005 for a real session id / cwd in the notify payload.
• Improve the heuristic (e.g. correlate by recent activity timestamp) until upstream lands.

Refs: README Limitations, openai/codex#4005.