fix: recover Codex rotation auth failures

- mark Codex bearer/refresh failures as terminal auth-expired states

- sync refreshed session auth back to rotation slots and revive refreshed dead_auth slots

- stop paired arbiter retry loops when Codex accounts are unavailable

- add regression coverage for rotation leases, follow-up suppression, and arbiter closure

src/paired-execution-context.ts

@@ -666,7 +666,11 @@ export function completePairedExecutionContext(args: {
         return;
       }
       if (role === 'arbiter') {
-        handleFailedArbiterExecution({ task, taskId });
+        handleFailedArbiterExecution({
+          task,
+          taskId,
+          summary: args.summary,
+        });
         return;
       }
       handleFailedOwnerExecution({ task, taskId, summary: args.summary });