[macstudio-3]

Problem

A Codex carrier can spend the whole caller allowance reconnecting to an overloaded upstream and return only CARRIER_EXIT_NONZERO, leaving the caller unable to distinguish an unavailable execution without opening worker reasoning.

Change

• Project a bounded, sanitized execution_failure object after an invoked nonzero carrier.
• Recognize only the exact terminal Codex overload messages; keep malformed, unknown, truncated, scanner-failure, and zero-exit cases fail-closed.
• Preserve opaque logs, artifact/completion semantics, retry/fallback ownership, teardown, and caller-owned time limits.
• Add synthetic carrier coverage for classification, sanitization, bounded tail scanning, unavailable projection, and unchanged completion checks.

Validation

• python3.12 skills/sshx/tests/test_run_codex_worker.py (65 tests)
• python3.12 -m unittest discover -s skills/sshx/tests -p 'test_*.py' (252 tests)
• python3.12 .github/tests/test_repository_docs.py (9 tests)
• bash -n skills/sshx/scripts/run-codex-worker.sh
• git diff --check

Closes #1077