fix: validate explicit Codex homes against live writer ownership #108

Problem

session-peer send --codex-home ... currently returns an explicit_selection resolution before it validates writer ownership across duplicate copies of the same Codex thread.

A real failure mode is a thread UUID exposed through multiple Codex homes (including hard-linked rollout/state copies): automatic resolution correctly finds a single stable live writer, but an explicit inactive home bypasses that evidence and queues into the wrong native queue.

Proposed behavior

• Inspect every known candidate containing the thread with the existing advisory-lock writer probe.
• Preserve automatic selection when exactly one stable live writer exists.
• Fail closed on unknown probes or multiple live writers.
• Revalidate PID, process start time, and held writer lock immediately before queue submission.
• Do not let explicit --codex-home bypass writer validation.
• If the explicit home is inactive while another candidate is the unique live writer, return a structured conflict; never silently switch homes.
• Separate intentionally queueing an all-inactive thread for a future resume behind a new explicit opt-in flag.
• Preserve the machine-readable codexHomeResolution envelope additively.

Compatibility

Explicit selection of the unique live writer remains valid. Existing intentional all-inactive explicit queues require the new opt-in, so the CLI should return a clear migration message and structured resolution rather than silently changing destination.

Acceptance criteria

• Advisory-lock integration tests cover unique live writer, hard-linked rollout copies, multiple live writers, unknown probes, explicit inactive conflict, and all-inactive opt-in.
• TOCTOU tests cover PID reuse/process start-time changes and lock ownership changes before queueing.
• Remote forwarding includes the opt-in flag.
• Documentation explains the compatibility change and never treats safeToUnlock as writer liveness.