feat: harden agent monitoring and add multi-provider quotas

[lchojnowski]

Summary

This draft consolidates upstream PRs #163 and #164 into one reviewable successor, together with subsequent Codex lifecycle, Herdr, CodexBar, privacy, and reliability work.

• Hardens native Codex lifecycle detection using bounded plugin hooks, rollout-tree validation, exact process incarnations, and conservative Unknown fallbacks.
• Adds exact Herdr session/pane/PID correlation for heuristic status detection and safe terminal focus.
• Expands the optional CodexBar integration to all configured providers and quota windows, with native-data precedence, provenance, responsive rendering, JSON, and --once support.
• Adds deterministic agent-tui coverage for Codex status, Herdr focus, CodexBar rendering, persistence, partial failures, and privacy boundaries.

Safety and privacy

• Never wraps, replaces, aliases, or proxies the native codex command.
• Ambiguous, stale, malformed, or contradictory lifecycle evidence fails closed to Unknown; heuristic rows remain non-actionable.
• Herdr focus authorization is separate from PID ownership and never grants kill permission.
• Codex hook state is bounded and content-free: no prompts, tool payloads, commands, credentials, environment, or transcript paths.
• Herdr terminal titles and screen contents are never ingested.
• CodexBar remains opt-in, bounded by timeout and output limits, and does not retain credentials, account identity, credits, pace data, dashboard content, or raw provider errors.

Validation

• 790 library tests
• 9 integration tests
• Strict Clippy with warnings denied
• Linux and Windows checks
• Release build
• Rustdoc with warnings denied
• ShellCheck
• agent-tui end-to-end suite
• Live CodexBar validation

Coordination

PRs #163 and #164 remain open for history and ongoing review. This draft is intended as their consolidated successor; they should remain open until the upstream maintainer decides how to proceed.