feat: upstream cli adaptation and settlement rework (0.0.35)

[okisdev]

summary

• codex companion targets cli 0.145.0: --output-schema flows end to end (rescue raw args, exec argv, structured output capture, a structured: render footer), adversarial review gains a json schema verdict contract, and the 0.144.4 models cache schema drift workaround is deleted with the tested interval moving to 0.145.0 to 0.146.0
• grok companion targets cli 0.2.110: setup probes the new grok doctor capability and reports it as an advisory, ordinary managed runs require --no-wait-for-background unconditionally, and best-of-n is retired so grok's protected roles shrink to four (burst, independence, live-web, large-context)
• settlement is centralized: engine acceptance writers move to a shared engine-acceptance.mjs, /fusion:stats records every verdict through the one --record <id>=<verdict> form, a verdict recorded before the worker record turns terminal queues and settles automatically on the terminal transition, and the worker lifecycle backfills peer identity from rescue wrapper stops (the SubagentStop matcher now also covers codex:codex-rescue, grok:grok-rescue, and grok:grok-review-runner)
• legacy codex plugin state support is dropped from stats, breaker, and monitor, and the inline delegation guard always normalizes persisted dispatch counters instead of branching on a legacy period counter

breaking changes

• /fusion:stats --record-acceptance and --record-worker-acceptance are removed; use --record <id>=<verdict>[:accept-failed-transport]
• the /grok:best-of-n skill, the best-of-n protected role, and --transport-default-best-of-n are removed
• FUSION_CODEX_INCLUDE_LEGACY and the codex-openai-codex compatibility state root are no longer read, and legacy completed/failed terminal statuses are no longer recognized
• the codex companion now expects codex cli 0.145.0 to 0.146.0, and the grok companion drops the --background-wait-timeout fallback, requiring a grok cli that supports --no-wait-for-background

test plan

already verified

• npm test -> 896 pass, 0 fail, 1 skip (897 tests)
• node bench/manifest.mjs --check -> manifest up to date
• json manifests parse (marketplace, plugin manifests, rules manifest, verdict schema, hooks)

reviewer should verify

• ci matrix (ubuntu/macos x node 22/24) and the plugin validate job come back green