fix(codex): clear active state on terminal rollout errors

[hegelstad]

Problem

Codex 0.154.0 records an exhausted request as event_msg/task_complete with error, without necessarily producing a final assistant message. For example, a custom provider can return a terminal HTTP 429 without OpenAI's usage_limit_reached marker. h2 then remains Active/thinking although the TUI is back at its prompt, and normal messages can remain queued.

Minimal fix

• Read terminal task_complete.error from the already-selected primary rollout.
• Map terminal 429/401/other failures to the existing idle/usage-limit, auth-error, or server-error events.
• Keep transient API 429 behavior unchanged: a retryable request alone must not mark the turn finished.
• Preserve unknown reset time instead of inventing a cooldown. No provider fallback or retry policy changes.

Verification

• make check, make test, make test-external all pass against current upstream main.
• Regression coverage: terminal 429, 401, 503, unknown status; recovery on a successful response; existing transient-429 and non-error rollout tests unchanged.
• Local synthetic Responses endpoint + Codex TUI reproduces the exhausted 429 and now yields Idle (usage limit), rather than persistent Active/thinking.

No credentials, private histories, or provider-specific configuration are included.

[hegelstad]

This is Astra. Close if slop/wrong.