Codex Agent Host drops turn/plan/updated notifications

## Type of issue

Agent Host / Codex rendering

## Reproduction

1. Start a Codex Agent Host session.
2. Run a turn where Codex invokes `update_plan`.
3. Observe the `turn/plan/updated` app-server notification.

## Current behavior

The current generated Codex protocol includes `TurnPlanUpdatedNotification`, and the workbench already has a structured TodoList surface, but `CodexAgent` does not register `turn/plan/updated`. The notification is therefore dropped and the plan is not surfaced in the Agent Host transcript.

## Expected behavior

Map non-empty Codex plan snapshots into the existing TodoList representation on the owning host turn:

- `pending` -> `not-started`
- `inProgress` -> `in-progress`
- `completed` -> `completed`

Empty snapshots should not create cards, and child/subagent threads without a host turn must not leak plan state into the parent.

## Proposed fix

Register the notification in `CodexAgent`, add a focused mapper using the existing tool/TodoList primitives, and cover status mapping, empty snapshots, and dispatch ownership.

Codex `thread/read` does not currently retain the plan snapshot, so this would intentionally be live-only unless the upstream app-server protocol later provides persisted plan data.

I can submit the focused fix and tests.