fix: recover Codex rotation auth failures

- mark Codex bearer/refresh failures as terminal auth-expired states

- sync refreshed session auth back to rotation slots and revive refreshed dead_auth slots

- stop paired arbiter retry loops when Codex accounts are unavailable

- add regression coverage for rotation leases, follow-up suppression, and arbiter closure

src/streamed-output-evaluator.test.ts

@@ -513,18 +513,26 @@ describe('evaluateStreamedOutput', () => {
 
   describe('error → Codex rotation trigger', () => {
     it('returns rotation trigger for Codex primary', () => {
+      const errorMessage =
+        'unexpected status 401 Unauthorized: Missing bearer or basic authentication in header';
       vi.mocked(detectCodexRotationTrigger).mockReturnValue({
         shouldRotate: true,
         reason: '429',
       });
 
       const result = evaluateStreamedOutput(
-        errorOutput('429 rate limit'),
+        errorOutput(errorMessage),
         freshState(),
         codexOpts,
       );
-      expect(result.newTrigger).toEqual({ reason: '429' });
-      expect(result.state.streamedTriggerReason).toEqual({ reason: '429' });
+      expect(result.newTrigger).toEqual({
+        reason: '429',
+        message: errorMessage,
+      });
+      expect(result.state.streamedTriggerReason).toEqual({
+        reason: '429',
+        message: errorMessage,
+      });
     });
 
     it('does not check Codex rotation for Claude agent type', () => {