fix(proxy): integrate transport reliability fixes

[kevinsslin]

Summary

Integrates the three transport-reliability fixes we are maintaining for the production fork on top of the current upstream main:

• syncs the fork from 2164b8c0 to upstream c3f0c568;
• adds the bounded five-second direct WebSocket scope cleanup budget from fix(proxy): separate websocket scope cleanup budget Soju06/codex-lb#1723;
• adds low-cardinality WebSocket cleanup_phase observability from feat(proxy): report websocket cleanup phase Soju06/codex-lb#1726;
• adds one narrowly bounded same-account/same-anchor recovery attempt for eventless HTTP Responses continuations from test(proxy): keep eventless anchored bridge replay fail-closed Soju06/codex-lb#1736.

This PR is the deployment integration branch for kevinsslin/codex-lb. The upstream PRs remain open for independent maintainer review.

Why

The live v1.23.0 VPS continued to show missing_response_created_timeout, upstream_request_timeout, cleanup budget warnings, repeated 503 cooldown responses, and Codex tasks pausing after reconnect exhaustion. The official fixes are not yet merged into an upstream release.

Safety

• preserves the existing shared shutdown deadline;
• keeps eventful, file-pinned, soft-affinity, cross-account, and repeated failures fail-closed;
• adds no environment variables, migrations, public APIs, or dependencies;
• retains the PyPI codex-lb==1.23.0 rollback path.

Validation

• combined targeted suite: 822 passed;
• uv run ruff check app tests;
• uv run ruff format --check app tests — 896 files formatted;
• uv run ty check;
• uv run python scripts/check_proxy_architecture.py;
• all three OpenSpec changes validated with --strict;
• all OpenSpec specs: 57 passed, 0 failed;
• git diff --check upstream/main...HEAD.

Deployment

After merge, the VPS will install this fork's exact merged main SHA rather than the moving branch name, restart codex-lb, and run health plus bounded transport/log canaries.