fix: recover Codex rotation auth failures

- mark Codex bearer/refresh failures as terminal auth-expired states

- sync refreshed session auth back to rotation slots and revive refreshed dead_auth slots

- stop paired arbiter retry loops when Codex accounts are unavailable

- add regression coverage for rotation leases, follow-up suppression, and arbiter closure

src/agent-attempt-retry.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, it } from 'vitest';
+
+import { resolveAttemptRetryAction } from './agent-attempt-retry.js';
+
+describe('resolveAttemptRetryAction', () => {
+  it('uses the streamed Codex trigger message as the rotation message', () => {
+    const errorMessage =
+      'unexpected status 401 Unauthorized: Missing bearer or basic authentication in header';
+
+    const action = resolveAttemptRetryAction({
+      provider: 'codex',
+      canRetryClaudeCredentials: false,
+      canRetryCodex: true,
+      attempt: {
+        sawOutput: false,
+        streamedTriggerReason: {
+          reason: 'auth-expired',
+          message: errorMessage,
+        } as any,
+      },
+    });
+
+    expect(action).toEqual({
+      kind: 'codex',
+      trigger: { reason: 'auth-expired' },
+      rotationMessage: errorMessage,
+    });
+  });
+});