[codex] Stabilize serverless sleep wake transitions

[arjunkomath]

Summary

Stabilizes serverless sleep/wake handling across the agent and control plane.

• adds transition IDs and CP ACKs so the agent only clears serverless sleep/wake reports after the CP applies or explicitly rejects them
• keeps reconcile guards active until expected state reflects the accepted transition
• gates gateway wake readiness on a TCP connection to the local upstream instead of only container running state
• repairs the observed incident state where a serverless deployment is desired running but stuck with stale observed_phase=stopped while the agent reports the container running

Root Cause

The agent treated HTTP 200 from status reporting as proof that a serverless transition was applied. The CP could reject a sleep transition because the deployment was outside its sleepable state window, but the agent still cleared its guard. Reconcile would then restart the stopped container, the idle timer would fire again, and the system could flap.

A second issue made wakes look ready before the app port accepted connections. The gateway considered a running container ready when there was no health check, which could produce early 502/503 responses.

The DB query for the live service showed the concrete wedge was runtime_desired_state=running with stale observed_phase=stopped, not a failed/autoheal variant. The reducer now repairs that narrow serverless state when a live running report proves the container is up.

Validation

• pnpm exec tsc --noEmit
• pnpm test
• go test ./...