hardening: Codex runtime fixes for 1.0.x

[loong10k]

Implementation branch for the approved Codex runtime hardening plan. Work is in progress and follows TDD task-by-task.

[loong10k]

Task 2 Ruling: the planned execAndParse force-JSON test is a regression guard rather than a RED test on the current baseline, because defaultOptions() already hardcodes json(true). RED is established by the new jsonOutput=false normal-exec test and noAltScreen interactive-default test. We still keep the execAndParse test so the refactor cannot accidentally make it inherit jsonOutput=false. Cost if wrong: parsed JSONL could silently stop working when users disable normal JSON output.