Fix Codex saved histories that reference replaced rollout files

[danshapiro]

Codex sessions that replace their rollout file or reference a prefix of an older rollout now appear as one saved session. Freshell follows the selected history head, reads only the referenced byte and message boundaries, and uses the logical session ID when resuming. Both search paths see the same selected history.

The resolver observes Codex's read-only SQLite selection and archived rollouts, invalidates cached dependencies when they change, and reports unresolved histories with structured logs. Unclassified copies remain quarantined; removing a copy restores the saved row without a browser reload. Running terminals remain available during quarantine.

Also repairs the FreshAgentView test race that could assert against a detached lazy-Markdown fallback node.

The disposable Docker test sandbox now reaps orphaned child processes. A controlled reproduction showed that accumulated zombies can exhaust its existing 512-process limit and cause terminal-creation checks to time out; Docker's init process prevents that accumulation while retaining the limit.

Validation:

• Full supported check: typechecks, 8,631 client tests, 395 Electron tests, 10 source-runtime tests, and the complete Rust workspace suite passed.
• Cloud browser suite: all 11 affected tests passed with no retries or skips, covering selected-prefix search, logical-ID resume, collisions, and copy-removal recovery.
• Read-only scan of the actual affected Codex data: five logical sessions each produce one saved row, with no unresolved histories.
• Regression tests were demonstrated failing before the corresponding fixes.
• Sandbox process cleanup was demonstrated failing without init and passing with init; terminal restart tests passed under the same four-test concurrency.

Deployment of the live Rust server is a separate operation.