feat(lanes): auto-advance a codex lane's stage from its rollout detection

A codex session emits no hooks and rarely calls `ccam stage` on its own, so
its card sat at `idle` forever while the amber "detected" badge was the only
thing that ever moved. `codex-ingest.js` now advances the declared `stage`
from its own written detection — the one place in CCAM where an inference
moves the blue `current` ring, and only for `codex` lanes.

It stays honest: gated on `recordDetection` having written (so forward-only,
declared-wins and the detection TTL are inherited unchanged), passes NO
evidence (the node renders `passed-no-evidence` amber, never `done`), and no
template's last node carries detect rules, so a lane can never be
auto-declared `done`. `setStage` grows a `keepDetection` option — its sole
caller — so the detection columns survive the advance and the card keeps
showing which command moved it instead of looking like an agent's own claim.

Two levers then get the evidence auto-advance cannot supply:

- `codex-nudge.js` now nudges on a stage held 2+ min with no evidence,
  instead of on a detection sitting ahead of the declared stage — after
  auto-advance the old condition can never fire, since the two now match.
- `ccam lanes agents install` on a codex lane writes the marker-delimited
  `<!-- ccam:stage:start -->` block into the lane's own AGENTS.md — the one
  instruction channel Codex reads — instead of copying agent templates into
  `.claude/agents/`, which it never loads. Appended, user prose preserved,
  reinstall replaces exactly that block.

Verified with a real `codex exec` run: stage moved to `watching-pr` with
`evidence: null` and the detection signal intact. 1364 server tests pass.

AGENTS.md

@@ -37,15 +37,16 @@ ccam stage <stage> --tool codex --evidence "<what is actually done>"
   a step of the actual work.
 
 The dashboard also *infers* your stage from your tool calls (it reads Codex's
-own rollout journals — see `docs/LANES.md#stage-detection`), but an inference
-only paints a dashed amber badge. It never counts as evidence and never renders
-a node green. Only your own declaration does.
+own rollout journals — see `docs/LANES.md#stage-detection`), and on a codex lane
+that inference does move the pipeline map forward on its own. It still never
+counts as **evidence**: a node it moved through stays amber and never renders
+green. Only your own declaration does that — which is why the call above is
+worth making even when the map already looks right.
 
-If you go a while without declaring while that inference has clearly moved
-past your last declared stage, the dashboard may type a one-line `[ccam]`
-reminder straight into this pane asking you to run `ccam stage`. That is the
-dashboard, not the user — treat it as the same instruction as this section and
-just make the real call.
+If you hold a stage for a while with no evidence recorded, the dashboard may
+type a one-line `[ccam]` reminder straight into this pane asking you to run
+`ccam stage ... --evidence "..."`. That is the dashboard, not the user — treat
+it as the same instruction as this section and just make the real call.
 
 ## Where to work
 - `server/` for API/routes/data processing.