fix(broker): stop tearing down a live broker that misses the readiness probe

[mzl9039]

Problem

ensureBrokerSession() probes the persisted broker with a 150 ms budget:

// plugins/codex/scripts/lib/broker-lifecycle.mjs
return await waitForBrokerEndpoint(endpoint, 150);

A broker that is currently serving a turn keeps its event loop busy, so it can easily
fail to accept the probe connection inside that window. The failed probe is then treated
as "the broker is gone" and the session is torn down.

Today that teardown mostly orphans the broker (this is #753). But once killProcess is
wired up — which is exactly what #762 does — the same path kills a perfectly healthy
broker, taking down its app-server and the in-flight turn with it. The caller sees:

codex app-server exited before the turn completed.

A second, independent race makes it easier to hit: ensureBrokerSession() has no mutual
exclusion, so concurrent clients can all observe loadBrokerSession() === null, each spawn
a broker, and let the last writer win — orphaning the other brokers along with the
app-servers and turns they own.

Reproduction

Submit two background tasks in the same workspace a few seconds apart:

node plugins/codex/scripts/codex-companion.mjs task "<long read-only task>" --background
sleep 3
node plugins/codex/scripts/codex-companion.mjs task "<another long read-only task>" --background

	before	after
first task	failed — codex app-server exited before the turn completed.	completed
second task	running → completed	completed
broker processes	replaced each other, then none	one, reused
app-servers killed mid-turn	yes	none

Fix

1. Raise the readiness probe budget to 3 s, and never tear down a broker whose process
   is still alive. A failed probe only proves the broker did not answer in time; only
   ESRCH from process.kill(pid, 0) proves it is gone (EPERM and PID reuse are
   treated conservatively as alive).
2. Serialize the check-then-create window with a stale-aware lock file, so concurrent
   callers share one broker instead of racing to create several.

If the lock cannot be acquired within its budget the code falls through to the previous
behaviour rather than failing the caller outright.

Tests

tests/broker-lifecycle.test.mjs adds two cases. Both fail on main with the
relevant assertion and pass with this change:

• a live broker must never be killed after a failed probe
• concurrent callers must share one broker

Full suite: 93 passing (91 before + 2 new), no regressions.

Note: running the suite inside a live Claude Code session needs
env -u CLAUDE_PLUGIN_DATA -u CODEX_COMPANION_SESSION_ID, otherwise
state.test.mjs picks up the ambient plugin data dir — that is #456, not this change.

Relationship to existing work

• ensureBrokerSession() deletes a live broker's state without killing it — the only production caller passes no killProcess #753 reports the teardown path; this PR addresses why the teardown is entered at all.
• fix: terminate broker process when ensureBrokerSession tears down (fixes #753) #762 wires up killProcess for that teardown. The two are complementary, but merging
  fix: terminate broker process when ensureBrokerSession tears down (fixes #753) #762 without this change converts an orphaned-broker leak into an actively killed
  in-flight turn.
• fix: stop broker readiness race and reap prior-session orphans #404 targets the readiness race from the orphan-reaping angle.
• Ending any Claude session kills the shared broker mid-turn: concurrent sessions' tasks die silently (exit 0) and stay "running" forever #540 / Shared per-workspace broker is torn down by any session's SessionEnd, killing other sessions' in-flight jobs #671 cover the SessionEnd teardown path, which is a different trigger for the
  same class of failure.