feat(import): anchor Codex turns to recorded commits

[yinguangyao]

Summary

entire import codex already restores historical Codex turns, but the Codex importer never populated Turn.CommitSHAs. Every imported turn therefore used the default-branch fallback introduced in #1825, even when the rollout recorded the exact git commit invocation and its resulting SHA.

This PR extracts explicit commit candidates from current Codex rollout formats and hands them to the existing turnAnchorResolver:

• pairs calls and outputs by call_id
• supports standard function_call / exec_command and custom_tool_call / exec envelopes
• unwraps static tools.exec_command({cmd: ...}) JavaScript calls, while rejecting dynamic template interpolation
• recognizes git commit only at unquoted shell command boundaries
• ignores explicit non-zero exit codes
• accepts only Git standard [branch <sha>] subject success headers
• preserves transcript order and de-duplicates candidates

The existing resolver remains the authority for expanding candidates and requiring default-branch reachability. No time/file heuristics or metadata schema changes are added.

Why

Historical import should use exact evidence when the agent recorded it. Without this, a turn that visibly created a commit is displayed at the import-time default branch head instead of that commit.

A privacy-preserving local audit over one repository last 30 days found:

• 103 Codex sessions / 606 imported turns
• 24 turns with explicit commit candidates
• 30 extracted candidates
• all 30 resolved to commit objects in that repository

The audit printed only aggregate counts; no prompt, command, or output content was retained.

Tests

• go test ./cmd/entire/cli/agentimport -count=1
• mise run lint
• real-rollout aggregate audit described above

mise run check was also attempted. Formatting and all lint jobs passed, and the changed agentimport package passed under the race run. The full suite failed in unrelated existing tests that dirtied .story/logs/story.log during branch checkout (TestReconcileDisconnected_NoRemote, TestIsMetadataDisconnected_NoRemote) and TestRunUninstall_Force_NothingInstalled; no failure referenced the changed files.