fix: prevent auto-resume of old Codex sessions from before startup

CODEX_SESSION_SCANNER was incorrectly auto-resuming old sessions because
session files persist after Codex exits. Fixed by:

1. Only matching sessions created AFTER hapi startup (reject if
   sessionTimestamp < referenceTimestampMs)
2. Snapshot resumeSessionId at startup so scanner callbacks don't
   affect codexLocal's launch parameters
3. Updated session timestamp test to verify boundary conditions

cli/src/codex/codexLocalLauncher.ts

@@ -11,6 +11,7 @@ export async function codexLocalLauncher(session: CodexSession): Promise<'switch
     let exitReason: 'switch' | 'exit' | null = null;
     const processAbortController = new AbortController();
     const exitFuture = new Future<void>();
+    const resumeSessionId = session.sessionId;
 
     // Start hapi server for MCP bridge (same as remote mode)
     const { server: happyServer, mcpServers } = await buildHapiMcpBridge(session.client);
@@ -28,7 +29,7 @@ export async function codexLocalLauncher(session: CodexSession): Promise<'switch
     };
 
     const scanner = await createCodexSessionScanner({
-        sessionId: session.sessionId,
+        sessionId: resumeSessionId,
         cwd: session.path,
         startupTimestampMs: Date.now(),
         onSessionMatchFailed: handleSessionMatchFailed,
@@ -102,7 +103,7 @@ export async function codexLocalLauncher(session: CodexSession): Promise<'switch
             try {
                 await codexLocal({
                     path: session.path,
-                    sessionId: session.sessionId,
+                    sessionId: resumeSessionId,
                     onSessionFound: handleSessionFound,
                     abort: processAbortController.signal,
                     codexArgs: session.codexArgs,