[codex] Contain upstream compatibility IDs

[8Dionysus]

Summary

• add a single source/runtime upstream compatibility bridge config
• route runtime evidence, playbook automation, A2A closeout, memo contradiction, RPG projection, and layout checks through that bridge
• tighten validators/tests/docs so noisy upstream IDs stay in the bridge or legacy inventory instead of active surfaces

Validation

• python -m pytest -q
• python scripts/validate_stack.py
• python scripts/validate_nested_agents.py
• python scripts/build_diagnostic_surface_catalog.py --check
• python scripts/validate_diagnostic_surface_catalog.py
• shellcheck -x mechanics/runtime-lifecycle/parts/layout-install/aoa_check_layout.sh scripts/aoa-check-layout
• git diff --check
• tracked-file hygiene scan for live/private/heavy artifacts

Notes

Source-only mirror change. No live runtime sync, secrets, models, logs, or service lifecycle changes.