fix: recover Codex rotation auth failures

- mark Codex bearer/refresh failures as terminal auth-expired states

- sync refreshed session auth back to rotation slots and revive refreshed dead_auth slots

- stop paired arbiter retry loops when Codex accounts are unavailable

- add regression coverage for rotation leases, follow-up suppression, and arbiter closure

src/message-agent-executor-paired.ts

@@ -505,8 +505,11 @@ class PairedExecutionLifecycleController implements PairedExecutionLifecycle {
     if (!missingVisibleVerdict) {
       return false;
     }
-    this.pairedExecutionSummary =
+    const noVerdictSummary =
       'Execution completed without a visible terminal verdict.';
+    this.pairedExecutionSummary = this.pairedExecutionSummary
+      ? `${this.pairedExecutionSummary}\n${noVerdictSummary}`
+      : noVerdictSummary;
     log.warn(
       {
         pairedTaskId: pairedExecutionContext?.task.id ?? null,