fix(lanes): auto-detect and report stage for codex lanes (issue 11)

A lane on the 16-node `ship-feature` template showed an untouched pipeline
map and never declared a stage. Four independent causes, fixed at their
shared choke points:

1. Codex emits no hooks, so `touchLaneFromHook` — the only caller of
   `stage-detect.detect()`, and correctly pinned to `claude` — could never
   see a `codex` lane. New `server/lib/codex-ingest.js` tails Codex's own
   rollout journals (`$CODEX_HOME/sessions/**/rollout-*.jsonl`), maps its
   tool calls onto the hook-shaped `{tool_name, tool_input}` the matcher
   already understands, and feeds the existing detect path plus an
   idle/running status mirror under the same guard hooks use. Polled every
   `DASHBOARD_CODEX_POLL_MS` ms (default 15000, `0` disables).
2. `resolveLaneArg` matched on cwd alone, so with a claude and a codex lane
   at one directory (the composite `idx_lanes_cwd_tool`) a `ccam stage`
   call could drive the sibling lane's card. It now resolves by
   `--lane` → `CCAM_LANE_ID` → `--tool`/harness marker → owning lane, and
   errors naming both candidates rather than picking one. Every pane the
   dashboard starts carries `CCAM_LANE_ID` (`tmux new-session -e`, or an
   assignment prefix when typing into a live shell pane).
3. `recordDetection`'s declared-wins veto had no exit: a lane left at the
   pipeline's last node rejected every detection for the rest of its life.
   A declaration on the LAST node no longer vetoes — the pipeline is over
   there, so a later detection is new work. Nothing else is relaxed, and
   detection still never writes `stage` nor renders `done`.
4. The run console pre-filled the pipeline's Claude slash command into
   codex panes, which Codex reads as prose — so the skill that would have
   called `ccam stage` never ran. Claude lanes only now.

A codex lane's *declared* stage still depends on the session calling
`ccam stage`; `AGENTS.md` is the only lever CCAM has, so it now says so.

Verified: server 1345/1345, client 441/441, and end-to-end against a real
codex lane row (detected_stage/detected_signal set, declared stage
untouched, no node rendered done).

server/__tests__/pty-run.test.js

@@ -82,7 +82,7 @@ describe("pty-run", () => {
     assert.ok(!calls.some((c) => c[0] === "new-session"), "must not create a duplicate session");
     const literal = calls.find((c) => c[0] === "send-keys" && c[3] === "-l");
     assert.ok(literal, "expected a literal send-keys with the command line");
-    assert.match(literal[4], /^'claude' .*'--resume' 'abc12345'$/);
+    assert.match(literal[4], /^CCAM_LANE_ID='8' 'claude' .*'--resume' 'abc12345'$/);
     assert.ok(
       calls.some((c) => c[0] === "send-keys" && c[3] === "Enter"),
       "expected the command to be submitted"
@@ -100,6 +100,38 @@ describe("pty-run", () => {
     assert.ok(literal.endsWith(`'don'\\''t; rm -rf /'`), literal);
   });
 
+  it("spawnRun puts CCAM_LANE_ID in the new session's environment", () => {
+    let newSessionArgv = null;
+    tmux.__setExecImpl((args) => {
+      if (args[0] === "has-session") {
+        const e = new Error("gone");
+        e.status = 1;
+        throw e;
+      }
+      if (args[0] === "new-session") newSessionArgv = args;
+      return "";
+    });
+    pty.spawnRun({ laneId: 33, cwd: "/tmp/repo", tool: "codex" });
+    const at = newSessionArgv.indexOf("-e");
+    assert.ok(at > -1, "expected a tmux -e environment flag");
+    assert.equal(newSessionArgv[at + 1], "CCAM_LANE_ID=33");
+    // Must stay ahead of the `--` that starts the pane's own argv.
+    assert.ok(at < newSessionArgv.indexOf("--"));
+  });
+
+  it("spawnRun prefixes CCAM_LANE_ID when typing into an existing shell pane", () => {
+    let literal = null;
+    tmux.__setExecImpl((args) => {
+      if (args[0] === "display-message") return "bash\n";
+      if (args[0] === "send-keys" && args[3] === "-l") literal = args[4];
+      return "";
+    });
+    pty.spawnRun({ laneId: 12, cwd: "/tmp/repo", tool: "codex" });
+    // An assignment prefix on the same line: tmux's -e only applies at session
+    // creation, and a live shell takes its env from the command line.
+    assert.match(literal, /^CCAM_LANE_ID='12' 'codex'/);
+  });
+
   it("spawnRun with resumeSessionId passes --resume in argv", () => {
     let newSessionArgv = null;
     tmux.__setExecImpl((args) => {
@@ -230,6 +262,11 @@ describe("pty-run", () => {
     return calls.find((c) => c[0] === "new-session");
   }
 
+  /** The pane's own command line — everything tmux passes after the `--`. */
+  function paneArgv(newSessionCall) {
+    return newSessionCall.slice(newSessionCall.indexOf("--") + 1);
+  }
+
   it("spawnRun builds a codex argv for a codex lane", () => {
     const call = captureNewSession(() =>
       pty.spawnRun({
@@ -243,7 +280,7 @@ describe("pty-run", () => {
         initialPrompt: "hello",
       })
     );
-    const argv = call.slice(7);
+    const argv = paneArgv(call);
     assert.deepEqual(argv, [
       "codex",
       "-m",
@@ -267,7 +304,7 @@ describe("pty-run", () => {
         resumeSessionId: "0199aaaa-bbbb-cccc-dddd-eeeeffff0000",
       })
     );
-    assert.deepEqual(withId.slice(7, 10), [
+    assert.deepEqual(paneArgv(withId).slice(0, 3), [
       "codex",
       "resume",
       "0199aaaa-bbbb-cccc-dddd-eeeeffff0000",
@@ -277,7 +314,7 @@ describe("pty-run", () => {
     const last = captureNewSession(() =>
       pty.spawnRun({ laneId: 9, cwd: "/tmp/repo", tool: "codex", resumeLast: true })
     );
-    assert.deepEqual(last.slice(7, 10), ["codex", "resume", "--last"]);
+    assert.deepEqual(paneArgv(last).slice(0, 3), ["codex", "resume", "--last"]);
   });
 
   it("spawnRun rejects a codex sandbox/approval outside the allowlist", () => {