fix: recover Codex rotation auth failures

- mark Codex bearer/refresh failures as terminal auth-expired states

- sync refreshed session auth back to rotation slots and revive refreshed dead_auth slots

- stop paired arbiter retry loops when Codex accounts are unavailable

- add regression coverage for rotation leases, follow-up suppression, and arbiter closure

src/provider-retry.test.ts

@@ -224,6 +224,7 @@ describe('runCodexRotationLoop', () => {
 
     expect(outcome).toEqual({ type: 'success' });
     expect(rotateCodexToken).toHaveBeenCalledTimes(1);
+    expect(rotateCodexToken).toHaveBeenCalledWith('auth-expired');
     expect(markCodexTokenHealthy).toHaveBeenCalledTimes(1);
   });