fix(codex): route busy steer to active turn

[LuneZ99]

What changed

• Route AIAgent.steer() through Codex app-server's native turn/steer RPC while a Codex turn is active.
• Keep the existing Hermes tool-result injection path for non-Codex runtimes.
• Require the RPC acknowledgement to contain the exact active turnId; rejection falls back to the Gateway FIFO queue.
• Add regression coverage for the missing AIAgent.steer() → request_steer() link and malformed acknowledgements.

Root cause

Gateway busy_input_mode=steer calls running_agent.steer(). The Codex-native call was only wired into redirect(), so steer() stored text in Hermes _pending_steer. Codex app-server owns its internal tool loop, meaning Hermes never reached the tool-result drain point. Gateway nevertheless reported success and skipped queueing the message.

NousResearch/hermes-agent main at 9829746d still has this routing gap. The strict acknowledgement change follows the complementary upstream PR NousResearch#82492.

Impact

Busy follow-ups now reach the active Codex turn. If there is no active turn, the RPC is rejected, times out, or returns an uncorrelated response, Hermes reports failure so Gateway queues the original message instead of dropping it.

Checks

• uv run ruff check . — passed
• git diff --check — passed
• 109 focused Codex/Gateway/steer tests — passed
• Full suite attempted with scripts/run_tests.sh -j 16; stopped after unrelated existing failures in LSP subprocess guarding, missing optional Anthropic SDK tests, and credential-pool routing.

Draft only: merge after the trading session and complete the Harness image verification before production rollout.