Stabilize channel senders and add runnable review witnesses

[5000Stadia]

Summary

• keep inferred Codex and Claude sender identities stable when tool shells change directories
• add repeatable, timeout-bounded agentpost review --check witnesses with machine-readable command/exit metadata
• fail closed on wrong HEAD, dirty or mutated worktrees, nonzero exits, and timeouts; revalidate the check context at delivery
• document the trust boundary, protocol, compatibility contract, and adapter generation updates

This is intentionally stacked on #2 so the diff contains only the sender-stability and runnable-review work requested through AgentPost.

Validation

• python -m unittest discover -s tests — 254 passed
• python scripts/verify_clean_install.py — Python 3.12 clean bootstrap passed
• ./scripts/smoke_two_agents.sh — passed
• python scripts/render_integrations.py --check
• python -m compileall -q src tests scripts
• node --check src/agentpost/data/codex_bridge.mjs
• sh -n scripts/install.sh
• git diff --check