feat: lane defaults, grok oidc refresh, codex 0.157 epoch (0.0.61)

[okisdev]

closes #56

summary

• a usage audit of 09-01 to 09-27 (1498 fusion tasks, 1521 codex jobs) and a same day model research pass drive this release; every number in the changelog comes from the worker ledger, the engine job stores or the session transcripts
• the routing table gains executable lane defaults (codex quick gpt-6-sol, volume gpt-6-luna and flagship gpt-6-astra at xhigh; grok burst, independence and live-web on grok-4.7-build-fast, large-context on grok-4.6), filled into fusion routed peer dispatches that omit --model or --effort; since 09-22 every fusion grok consult had run on the interactive default, a fast model at effort low
• codex 0.157 and grok 1.0.41 epochs: managed codex runs disable agents, connectors, plugins and computer use (six policy kills came from spawn_agent), timed out write jobs resume with --write, and grok refreshes an expired oidc token outside the sandbox and reruns once
• /fusion:stats stops reporting artifacts (codex 1288 unverified becomes 586 accepted, 139 rejected, 797 untracked), dispatch width is grouped by message id, and the worker lifecycle collects through final.txt, settles cap refusals and api deaths itself, recalibrates budgets and reopens tasks on SendMessage continuations with a per round budget

test plan

already verified

• npm test -> 1286 tests, 1285 pass, 0 fail, 1 skipped (the existing skip)
• claude plugin validate on plugins/codex, plugins/grok, plugins/fusion and the marketplace root -> all pass
• live grok 1.0.41: a six hour old token refreshed through grok models and the strict run answered
• live codex 0.157.1: /codex:setup reports ready, and a write task with an explicit --cwd outside git succeeds with the automatic --skip-git-repo-check
• node plugins/fusion/scripts/fusion-stats.mjs --all on live data -> codex 586 accepted, 139 rejected, 797 untracked, 0 unverified

reviewer should verify

• after a marketplace cache refresh and a session restart, /fusion:config audit shows the lane defaults, and a codex rescue brief whose first line starts with lane: and omits --model runs on gpt-6-sol at xhigh with the lane default notice
• /grok:setup --json reports auth.ageSeconds and auth.stale

notes

• plugins/fusion/rules-manifest.json is generated by plugins/fusion/scripts/generate-rules-manifest.mjs; the reviewable logic lives in worker-lifecycle.mjs, fusion-stats.mjs, inline-delegation-guard.mjs, model-table.mjs, codex-companion.mjs and grok-exec.mjs
• installed sessions pick up the lane defaults only after the cache refresh; the live routing tables on both hosts are already rescored, with the gpt-5.6-terra and gpt-5.6-luna rows marked superseded until this ships