[codex] route CI proof by maturity

[TheGreenCedar]

Summary

• keep draft and checkpoint pushes on one Ubuntu source lane plus focused docs/plugin checks
• promote exact reviewed heads once for full workspace tests and clippy
• route explicit platform proof by changed surface: no package matrix for guard non-rust evidence boundaries #1056-shaped guard changes, Mac-only proof for [codex] prove grounding-only managed plugin convergence #1058-shaped lifecycle work, and the full native matrix for migrate sidecar identity to v3 #1059-shaped runtime identity changes
• cancel stale PR runs, reuse each packaged binary through smoke/signing/notarization/install/Metal proof, and key caches by toolchain, lockfile, features, and target
• move repo-scale stats to the final promoted head and make integration proof an explicit current-dev dispatch

Verification

• actionlint -no-color .github/workflows/*.yml
• node .github/scripts/check-workflow-policy.mjs
• node .github/scripts/route-ci-proof.mjs --self-test
• real PR routing: guard non-rust evidence boundaries #1056 none, [codex] prove grounding-only managed plugin convergence #1058 macos, migrate sidecar identity to v3 #1059 full
• plugin static tests: 72 passed, 1 platform skip
• docs links, packaged proof/packager self-tests, release detector, version synchronization, and git diff --check

No Cargo lane was run for this workflow-only checkpoint. The commit carries [skip ci] so the old broad PR workflows do not fan out before this router is merged.

Closes #1060
Refs #1046