fix(codex): fail closed on ambiguous Web Rewind boundaries (#1707)

* fix(codex): fail closed on ambiguous Web Rewind boundaries

* fix(codex): reject malformed native rewind history

* fix(codex): reject duplicate rewind identifiers

* feat(codex): offer Fork fallback for ambiguous rewind

* fix(codex): gate rewind Fork fallback on exact native boundary

* fix(codex): reject unresolved rewind boundaries safely

* chore: trigger PR checks

* fix(codex): gate safe rewind fallback on fork support

* fix(codex): require complete user ids for rewind fallback

shared/src/apiTypes.ts

@@ -575,6 +575,10 @@ export type ForkConversationRpcResult = {
     forkSession?: boolean
 }
 
+export type RewindConversationErrorCode =
+    | 'ambiguous_native_boundary'
+    | 'ambiguous_native_boundary_fork_safe'
+
 export type RewindConversationRpcResult = {
     success: true
     /** Truncate HAPI transcript at/after this localId, then accept rehydrated history. */
@@ -588,6 +592,7 @@ export type RewindConversationRpcResult = {
 } | {
     success: false
     error: string
+    code?: RewindConversationErrorCode
     /** Native state is unchanged, cancelled, or was restored exactly. */
     outcome: 'rejected' | 'cancelled' | 'source_restored'
 }