feat(lanes): auto-advance a codex lane's stage from its rollout detection

A codex session emits no hooks and rarely calls `ccam stage` on its own, so
its card sat at `idle` forever while the amber "detected" badge was the only
thing that ever moved. `codex-ingest.js` now advances the declared `stage`
from its own written detection — the one place in CCAM where an inference
moves the blue `current` ring, and only for `codex` lanes.

It stays honest: gated on `recordDetection` having written (so forward-only,
declared-wins and the detection TTL are inherited unchanged), passes NO
evidence (the node renders `passed-no-evidence` amber, never `done`), and no
template's last node carries detect rules, so a lane can never be
auto-declared `done`. `setStage` grows a `keepDetection` option — its sole
caller — so the detection columns survive the advance and the card keeps
showing which command moved it instead of looking like an agent's own claim.

Two levers then get the evidence auto-advance cannot supply:

- `codex-nudge.js` now nudges on a stage held 2+ min with no evidence,
  instead of on a detection sitting ahead of the declared stage — after
  auto-advance the old condition can never fire, since the two now match.
- `ccam lanes agents install` on a codex lane writes the marker-delimited
  `<!-- ccam:stage:start -->` block into the lane's own AGENTS.md — the one
  instruction channel Codex reads — instead of copying agent templates into
  `.claude/agents/`, which it never loads. Appended, user prose preserved,
  reinstall replaces exactly that block.

Verified with a real `codex exec` run: stage moved to `watching-pr` with
`evidence: null` and the detection signal intact. 1364 server tests pass.

server/lib/lane-agents.js

@@ -1,5 +1,6 @@
 /**
- * @file Installs the ship-feature-lane pipeline's agent templates
+ * @file Installs a lane's driving instructions. For a `claude` lane that is
+ * the ship-feature-lane pipeline's agent templates
  * (qc-local, senior-gate-reviewer) into a lane's own .claude/agents/, so a
  * driving session can launch them by the BARE subagent_type name. Source is
  * the repo's own `agents/` — the same files the ccam plugin ships, where
@@ -19,6 +20,52 @@ const TEMPLATE_DIR = path.join(__dirname, "..", "..", "agents");
 const TEMPLATE_FILES = ["qc-local.md", "senior-gate-reviewer.md"];
 const EXCLUDE_LINE = ".claude/agents/";
 
+// Codex reads no `.claude/agents/`, so for a codex lane the useful thing to
+// install is the one instruction it DOES read: AGENTS.md, the project doc it
+// loads from the working directory. Marker-delimited so a reinstall replaces
+// exactly this block and never the user's own prose, and appended rather than
+// written over an existing file.
+const STAGE_BLOCK_START = "<!-- ccam:stage:start -->";
+const STAGE_BLOCK_END = "<!-- ccam:stage:end -->";
+const STAGE_BLOCK = `${STAGE_BLOCK_START}
+## Declare your lane stage as you work
+
+This directory is watched by CCAM. Its pipeline map advances on its own by
+*inferring* your stage from your tool calls, but an inference carries no
+evidence — the node stays amber, never green. Only your own declaration does:
+
+\`\`\`bash
+ccam stage <stage> --tool codex --evidence "<what is actually done>"
+\`\`\`
+
+- Call it at every real transition — starting to plan, starting to implement,
+  running tests, opening the PR — not once at the end.
+- \`--tool codex\` matters: one directory can back both a \`claude\` lane and a
+  \`codex\` lane, and without a tool the command fails rather than guess. Inside
+  a pane the dashboard started you need nothing — it carries \`CCAM_LANE_ID\`.
+- \`ccam stage\` warns on stderr and names the valid nodes if a stage matches
+  none of this lane's pipeline template.
+- If it reports that no lane owns this directory, skip the stage calls and
+  carry on. Stage reporting is reporting, never control flow.
+- A one-line \`[ccam]\` reminder may be typed straight into this pane asking for
+  evidence on the current stage. That is the dashboard, not the user — treat it
+  as the same instruction as this section and make the real call.
+${STAGE_BLOCK_END}`;
+
+/** Append the stage block to `<cwd>/AGENTS.md`, or replace an existing one. */
+function installStageDoc(cwd) {
+  const file = path.join(cwd, "AGENTS.md");
+  const existing = fs.existsSync(file) ? fs.readFileSync(file, "utf8") : "";
+  const start = existing.indexOf(STAGE_BLOCK_START);
+  const end = existing.indexOf(STAGE_BLOCK_END);
+  const next =
+    start !== -1 && end > start
+      ? existing.slice(0, start) + STAGE_BLOCK + existing.slice(end + STAGE_BLOCK_END.length)
+      : `${existing.trimEnd()}${existing.trim() ? "\n\n" : ""}${STAGE_BLOCK}\n`;
+  fs.writeFileSync(file, next);
+  return "AGENTS.md";
+}
+
 /** The dir shared across every worktree of a repo — where info/exclude
  *  lives (same as info/attributes; MERGE_HEAD/HEAD/the index are the only
  *  per-worktree-private state, not this). */
@@ -33,7 +80,10 @@ async function commonGitDir(cwd) {
  * any existing copy — this is a reinstall, not a merge) and idempotently
  * git-exclude that directory in the shared common git dir.
  *
- * @param {{cwd: string}} lane
+ * A `codex` lane gets the AGENTS.md stage block instead — Codex never reads
+ * `.claude/agents/`, and its own working copy is the only channel it does read.
+ *
+ * @param {{cwd: string, tool?: string}} lane
  * @returns {Promise<{installed: string[]}>}
  */
 async function installAgents(lane) {
@@ -43,6 +93,8 @@ async function installAgents(lane) {
     });
   }
 
+  if (lane.tool === "codex") return { installed: [installStageDoc(lane.cwd)] };
+
   const dest = path.join(lane.cwd, ".claude", "agents");
   fs.mkdirSync(dest, { recursive: true });
   const installed = [];