Notable upstream fixes:
- Fix working-tree review crash on untracked directories
- Avoid embedding large adversarial review diffs
- Inherit process.env in app-server spawn
- Scope implicit resume-last and cancel to current session
- Gracefully handle unsupported thread/name/set on older CLI
- Use app-server auth status for Codex readiness
The codex session-lifecycle-hook.mjs SessionStart path only appends
two env vars to CLAUDE_ENV_FILE. Rewrite that as a bash script to
avoid ~100ms V8 startup overhead. SessionEnd stays in Node.js since
it needs async broker teardown and process tree management.
