[codex] Refresh repair handoffs after main advances

[mberman84]

What changed

• refresh a conflict-repair handoff whenever main advances, even when the PR head and error text are unchanged
• preserve the original bounded repair-hold start so repeated main movement cannot extend the hold forever
• include the complete sealed PR→head map in integration repair packets and replace legacy/incomplete packets
• prove token-authored pull_request placeholders cannot suppress DeployBot-owned exact-branch CI dispatch
• surface the source-thread resume action in slow queue alerts
• explicitly forbid provider-side and direct-to-main merges in bundled agent guidance

Root cause

An existing merge-queue-blocked marker caused later promotion passes to treat a repair as already handed off. When main advanced again, affected source threads did not receive a fresh handoff for the new base SHA. Integration repair packets also omitted the complete sealed membership, making it harder for owners to prove every frozen source was present.

Validation

• PYTHONPATH=src python3 -m unittest discover -s tests — 258 passed
• python3 -m ruff check . — passed
• final autoreview — clean, no actionable findings