fix: prevent auto-resume of old Codex sessions from before startup

CODEX_SESSION_SCANNER was incorrectly auto-resuming old sessions because
session files persist after Codex exits. Fixed by:

1. Only matching sessions created AFTER hapi startup (reject if
   sessionTimestamp < referenceTimestampMs)
2. Snapshot resumeSessionId at startup so scanner callbacks don't
   affect codexLocal's launch parameters
3. Updated session timestamp test to verify boundary conditions

cli/src/codex/utils/codexSessionScanner.ts

@@ -336,7 +336,11 @@ class CodexSessionScannerImpl extends BaseSessionScanner<CodexSessionEvent> {
             return null;
         }
 
-        const diff = Math.abs(sessionTimestamp - this.referenceTimestampMs);
+        if (sessionTimestamp < this.referenceTimestampMs) {
+            return null;
+        }
+
+        const diff = sessionTimestamp - this.referenceTimestampMs;
         if (diff > this.sessionStartWindowMs) {
             return null;
         }