Accepted steers can disappear during interruption before persistence

Follow up to #45497.

Core tests reproduce an accepted steer disappearing from the rollout after interruption. They do not establish that this was the cause of the original desktop incident.

TurnInputSubmission::Steered acknowledges acceptance for processing, not completion of prompt hooks or persistence. There are two distinct cancellation windows:

• A steer still in the pending queue is cleared during abort cleanup.
• A steer already removed from the queue can be lost if cancellation stops its prompt hook before history recording. A test that waits for that hook to start, interrupts, and parses the saved user response items finds zero copies of the acknowledged steer. This occurs both before and with the proposed patch.

The proposal in diegomrsantos/codex#3 is not a verified fix. Review reproduced two regressions:

• It starts UserPromptSubmit hooks during abort and waits for them before TurnAborted. A gated hook holds interruption open until released. The same responsiveness test passes before the patch. Prompt hooks default to a 600 second timeout, unlike the short timeout for interrupt hooks.
• It emits completed user message events before TurnAborted. In the TUI, those events remove pending steers, so pressing Esc to submit them no longer starts the replacement turn. The existing TUI control test passes; delivering the new event sequence makes its submission assertion fail.

Preserving input must distinguish an unprocessed message from one accepted by hooks and committed to model history. Recording raw input directly would bypass hook rejection on resume; recovering it without stable retry identity can duplicate messages that clients resubmit. The existing queue for future turns deletes entries when a turn starts, so it does not supply that missing recovery contract.

The earlier assertions that the desktop cause was confirmed and that PR #3 fixed the loss have been withdrawn. The PR is a draft pending a safe recovery design and corresponding integration tests.

Start with the core tests reproducing accepted-steer loss, the TurnInputSubmission::Steered path, and the existing TUI control test. Trace abort cleanup, prompt-hook cancellation, and history recording before designing a recovery contract; done requires integration tests that preserve accepted steers without bypassing hook rejection, duplicating resubmissions, or delaying interruption.