feat(lanes): auto-advance a codex lane's stage from its rollout detection

A codex session emits no hooks and rarely calls `ccam stage` on its own, so
its card sat at `idle` forever while the amber "detected" badge was the only
thing that ever moved. `codex-ingest.js` now advances the declared `stage`
from its own written detection — the one place in CCAM where an inference
moves the blue `current` ring, and only for `codex` lanes.

It stays honest: gated on `recordDetection` having written (so forward-only,
declared-wins and the detection TTL are inherited unchanged), passes NO
evidence (the node renders `passed-no-evidence` amber, never `done`), and no
template's last node carries detect rules, so a lane can never be
auto-declared `done`. `setStage` grows a `keepDetection` option — its sole
caller — so the detection columns survive the advance and the card keeps
showing which command moved it instead of looking like an agent's own claim.

Two levers then get the evidence auto-advance cannot supply:

- `codex-nudge.js` now nudges on a stage held 2+ min with no evidence,
  instead of on a detection sitting ahead of the declared stage — after
  auto-advance the old condition can never fire, since the two now match.
- `ccam lanes agents install` on a codex lane writes the marker-delimited
  `<!-- ccam:stage:start -->` block into the lane's own AGENTS.md — the one
  instruction channel Codex reads — instead of copying agent templates into
  `.claude/agents/`, which it never loads. Appended, user prose preserved,
  reinstall replaces exactly that block.

Verified with a real `codex exec` run: stage moved to `watching-pr` with
`evidence: null` and the detection signal intact. 1364 server tests pass.

README.md

@@ -131,13 +131,18 @@ choices, and resumes with `codex resume --last`. Codex emits none of this
 dashboard's hooks, so a Codex lane records its runs but stays absent from
 Sessions and Analytics. Its **stage detection** works anyway, from Codex's own
 rollout journals on disk (`$CODEX_HOME/sessions/**/rollout-*.jsonl`, polled every
-`DASHBOARD_CODEX_POLL_MS` ms, default 15000) — what a Codex lane cannot get for
-free is a *declared* stage, since only the session itself can call `ccam stage`.
-Two things help it get there: the run console pre-fills a codex pane's opening
-prompt with a stage-declaration checklist built from its own pipeline nodes,
-and a 60s sweep (`DASHBOARD_CODEX_NUDGE_MS`, `0` disables) types a one-line
-reminder into a lane's pane if its detected stage sits fresh and undeclared for
-more than two minutes.
+`DASHBOARD_CODEX_POLL_MS` ms, default 15000), and on a Codex lane a detection
+also **advances the declared stage** — the one place an inference moves the blue
+`current` ring, because a Codex session has no hook and nothing else would ever
+move it. What a Codex lane cannot get for free is *evidence*: an auto-advanced
+node stays amber (`passed-no-evidence`), never green, since only the session
+itself can say what it finished. Three things help it get there: the run console
+pre-fills a codex pane's opening prompt with a stage-declaration checklist built
+from its own pipeline nodes, `ccam lanes agents install` writes the same
+instructions as a marker-delimited block in the lane's `AGENTS.md`, and a 60s
+sweep (`DASHBOARD_CODEX_NUDGE_MS`, `0` disables) types a one-line reminder into
+a lane's pane if its current stage sits without evidence for more than two
+minutes.
 
 The declared stage comes from `ccam stage`. The inferred stage comes from tool
 events and expires after `DETECTION_TTL_MS` (default 5 minutes), so a lane can