Provide a content-free session attestation channel: rollout path and/or caller-supplied thread id

Use case

We orchestrate fleets of coding-agent workers (one task per process) and meter
per-task token usage by reading each worker's own session file. Today Claude
and Pi both let the running session attest its own file at session start
(Claude: SessionStart hook carries transcript_path + session_id;
Pi: extension API getSessionFile() / getSessionId()), plus a
caller-supplied session pin (claude --session-id <uuid>,
pi --session-id <uuid>). Our observer then verifies the claim against the
file's own ownership record and never searches the filesystem.

Codex has no equivalent, so Codex workers are the one harness we cannot bind
without either searching session directories or consuming message text.

What we observed (codex-cli 0.155.0)

• codex exec --json emits thread.started {thread_id} as its first event:
  the thread id, but no rollout path.
• The notify program at agent-turn-complete receives thread-id,
  turn-id, cwd, client — plus input-messages and
  last-assistant-message, i.e. message content. No path.
• Project hooks (SessionStart/Stop) do not fire in exec mode, so there
  is no hook channel for workers.
• The rollout file (~/.codex/sessions/YYYY/MM/DD/rollout-<local-ts>-<thread-id>.jsonl)
  exists from thread start and its first session_meta record carries
  id + cwd, which is a fine ownership record to verify against — but
  reaching the path from the thread id means listing date directories across
  a local-time boundary, which is a heuristic search, not attestation.
• No flag pins a thread id (no --session-id analog), so attestation by
  construction is unavailable too.

The ask (either half unblocks us; both is best)

1. Attest the path: include the rollout file's absolute path in a
   content-free payload the worker channel already emits — e.g. a path /
   rollout_path field on the exec --json thread.started event and/or in
   the notify program's JSON argument.
2. Pin the identity: accept a caller-supplied thread id
   (e.g. codex exec --thread-id <uuid>), the analog of
   claude --session-id, so the spawner mints identity and the harness
   reports where the file is.

Privacy posture

The attestation must be content-free: path + thread id + cwd only, the same
posture as Claude/Pi attestation. Concretely, a notify payload used for
attestation should be consumable without the input-messages /
last-assistant-message fields — either a separate minimal event or
documented permission to ignore those fields. We will read only thread-id
and cwd plus the new path field, and never message text.

Why not the alternatives

• Parsing notify's message fields is a privacy regression we do not want.
• Deriving the path by scanning date directories is exactly the filesystem
  search our design refuses (racy across the local-time boundary, breaks
  under concurrent workers).
• Binding only at turn end loses the first turn's usage, which is usually the
  most expensive turn.

Happy to test a preview build and report back. Thanks for considering it.

Start with the codex exec --json thread.started event and the notify program's agent-turn-complete JSON arguments. Review the rollout file's session_meta record and the existing thread_id, cwd, and content fields described in the issue. Done means workers can attest the rollout path or caller-supplied thread identity using only content-free path, thread id, and cwd data.