Fix provider interruption handling and safe run resume

[hyspacex]

Interrupted provider tasks could hang indefinitely or be accepted from partial JSON. Resume could also skip an unfinished evaluation, lose repair context, or refuse to continue the last allowed sprint.

This update rejects failed/truncated provider streams, bounds Codex subprocess cleanup, isolates turn notifications, and resumes only from canonical evaluation/verdict checkpoints with intact frozen evidence. Incomplete rounds replay without consuming repair budget; completed failed rounds restore their repair instructions and generator session. Public CLI/config interfaces and model defaults are unchanged.

Validation:

• Independent code review, 75 automated tests (16 new failure/cleanup/resume regressions), harness compilation, app typecheck, app production build; dependency audit: 0 vulnerabilities.
• Real subscription-backed CLI runs in disposable workspaces: Codex gpt-6.1-sol minimal and flat; Claude Opus 5.5 minimal and full. All four completed with canonical verdicts, hash-verified frozen evidence, and passing final regression.
• Flat Codex uses a one-time injected harness smoke failure to exercise repair and generator-session reuse. Claude full exercises research, planning, negotiated contract, generation and evaluation; its generator consumed the one-time hook failure during self-verification, so it is not counted as a harness repair run.
• Transport crashes, forced process cleanup, interrupted-sprint resume and evidence corruption are deterministic automated fault-injection tests, not claimed as live service outages.

Live reproduction on the verification Mac (fixtures and logs retained outside the repository):

npm run build:harness
python3 ../reliability/run-live.py codex
python3 ../reliability/run-live.py claude
python3 ../reliability/run-live.py codex-minimal
python3 ../reliability/run-live.py claude-minimal

The driver invokes node dist/cli.js run <sum-module prompt> --config ../reliability/<case>/config.json. Configs select a single sprint, up to two repairs, no git auto-commit, and Node test smoke checks. Codex uses low effort and the standard service tier; Claude allows at most 40 turns per task. To repeat fault injection, use a fresh fixture directory or remove its injected-once marker.

No release/version bump. Existing frontend bundle-size warning remains; frontend files were not changed in this pass.