[P1] Bound the Codex WebSocket transport and close resources on every failure #35

Summary: Fix lifecycle and WebSocket framing in src/codex-bridge.js.
Why: upgrade/initialize failures leak sockets, fragmented text fails, handshake validation is weak, close leaves requests pending, and buffers/frames/messages are unbounded.
Acceptance criteria: one idempotent shutdown settling requests/timers; absolute deadlines; exact handshake validation; fragmentation/control-frame/UTF-8/opcode handling; header/frame/message/buffer budgets; fixtures for split, malformed, oversized, trickled, init-failure, pending, and repeated-close cases.

Parent: #24
Source: GPT-6 Pro post-land review of #27/#28 — https://chatgpt.com/c/6aa89f23-6920-83ea-b98a-a1f155a1ae3f