fix: validate explicit Codex home ownership - #109

An explicit --codex-home could previously bypass live-writer resolution and queue into an inactive duplicate while another home owned the thread. This change checks every known matching home for implicit and explicit sends, rejects an explicit-home/live-writer conflict without silently switching destinations, and compares the selected writer's PID, process start time, and held advisory lock immediately before queue submission.

All-inactive queues now require the deliberate combination --codex-home ... --allow-inactive-codex-home; --wake remains an explicit activation opt-in. codexHomeResolution stays at schema version 1 and adds reason values and ownerStartTime evidence without changing its envelope or status vocabulary. The new flag is forwarded over SSH.

The implementation keeps the built-in read-only advisory-lock probe instead of adding a runtime dependency on codex-unlock@0.1.0, which currently has no supported library exports. This preserves one-process deployment while following the same live_owner principle and never using safeToUnlock as liveness evidence.

Validation:

• PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -q — 357 passed, 8 skipped
• python3 -m unittest tests.test_docs_i18n -q — 5 passed
• python3 -m compileall -q cc_peer.py session_peer.py tests
• isolated python -m build — sdist and wheel built
• coverage includes a real POSIX advisory lock, hard-linked rollout copies, multiple/unknown writers, explicit inactive conflict, inactive opt-in, PID start-time change, TOCTOU revalidation, SSH option forwarding, and portable absent-lock classification

Closes #108.