feat: codex 0.147.0 + grok 1.0.0 epoch, live probe fixes (0.0.51)

[okisdev]

summary

• moves the verified peer CLI epoch to codex-cli 0.147.0 and grok 1.0.0: tested interval, verified-versions pin, contract docs, rules, skills, and both fake CLI fixtures move in lockstep, with the codex contract corrected to what setup actually does above the ceiling (ready false, exit 1, task and review preflight unaffected)
• fixes two regressions that only live probes caught: grok 1.0.0 emits snake_case stop reasons so the two literal "Cancelled" comparisons silently killed permission denial classification (now normalized, fixtures speak the live wire format), and a speculative x_search disallow tripped grok's unmatched disallowedTools warning into our fail-closed tracing and killed every non web run (reverted; the fixed --tools allowlist alone governs, live verified)
• accepts cache_creation_input_tokens in the grok usage invariant before a nonzero value would have rejected whole usage objects, wires the codex rollout inspector into the monitor's production path with an ambiguous_turns guard, recovers effort from the -c model_reasoning_effort= form codex actually emits, and points the argv scrape at the codex child pid
• pins grok 1.0.0's newly load bearing child env (GROK_WEB_FETCH by web mode, GROK_AUTO_WAKE and GROK_MANAGED_MCP_GATEWAY_TOOLS_ENABLED false, six inherited variables removed) and hardens the fixtures: fake-grok gains a --version branch and removable capabilities, fake-codex rejects subcommands it does not model

test plan

already verified

• npm test -> 1114 tests, 1113 pass, 0 fail, 1 standing skip on the merged tree
• live codex 0.147.0 probes: task with --output-schema returned the schema-constrained object via turn.completed, exec resume answered on the stored thread id, rollout sidecar present under sessions/2026/08/07
• live grok 1.0.0 probes: strict no web consult self reported exactly read_file, list_dir, grep; write mode appended the requested line under the sandbox handshake; web consult fetched example.com with GROK_WEB_FETCH pinned
• codex review over the working tree diff (wind down salvaged): six findings, all verified real, all fixed in this PR

reviewer should verify

• /codex:setup on codex-cli 0.147.0 reports ready true, and on a hypothetical 0.148.0 reports the compatibility advisory with exit 1

notes

• after merge: refresh the installed plugin caches to 0.0.51, run the first live /fusion:smoke, then /fusion:stats --prune-dead per the release cadence
• the codex live listing carries five unscored models (codex-auto-review, gpt-5.3-codex-spark, gpt-5.4, gpt-5.4-mini, gpt-5.6-sol-wm); re-scoring stays a /fusion:config decision and is deliberately not part of this release