fix: recover Codex rotation auth failures

- mark Codex bearer/refresh failures as terminal auth-expired states

- sync refreshed session auth back to rotation slots and revive refreshed dead_auth slots

- stop paired arbiter retry loops when Codex accounts are unavailable

- add regression coverage for rotation leases, follow-up suppression, and arbiter closure

src/message-agent-executor-attempt-runner.ts

@@ -14,6 +14,7 @@ import {
   shouldResetCodexSessionOnAgentFailure,
   shouldResetSessionOnAgentFailure,
 } from './session-recovery.js';
+import { getErrorMessage } from './utils.js';
 import type {
   AgentType,
   OutboundAttachment,
@@ -162,6 +163,9 @@ class MessageAgentAttemptRunner {
       );
       return this.buildAttempt({ output });
     } catch (error) {
+      this.args.pairedExecutionLifecycle.updateSummary({
+        errorText: getErrorMessage(error),
+      });
       return this.buildAttempt({ error });
     }
   }