codex runtime: mail-task auto-commit gates the right repository, handles a stale rebase correctly, and says what its checks prove #800

The codex runtime's mail-task auto-commit block (packages/cli/src/utils/codex-runtime.ts, after a mail task completes) has several defects found while reviewing #784, which only reindents that block. They are moved here so #784 stays the shutdown fix it is. A starting implementation (from #784 rounds 8-9) is on branch wip/784-autocommit-hardening (head 86b4fb3): it already covers items 2-4 below and has real-Git tests for checkout layouts and both rebase backends.

What the fix does:

1. One repository. Choose the commit repository once (config.autoCommit.repo ?? config.workspace) and use it for every Git probe (baseline HEAD, stale-rebase check, status, current HEAD) and for the rebase abort, so a configured repository override cannot carry a stale rebase past the gate or hide its changes. Test with two real repositories and a configured override.
2. Stale rebase detected by Git. Ask Git where the rebase state lives (git rev-parse --path-format=absolute --git-path rebase-merge / rebase-apply) instead of parsing .git / gitdir: by hand (which copies a relative gitdir and checks only rebase-merge for a linked worktree); a failed probe is indeterminate: skip auto-commit and report it.
3. A successful abort resets the comparison. Aborting an interrupted rebase restores HEAD, so the pre-task baseline is no longer a valid comparison: compare against the restored state (or skip auto-commit and report it). Real-Git regression: a successful abort followed by a no-change task does not enter auto-commit.
4. Messages say what the probes establish. The comment, warning, sender mail and docs say "Git status is clean and HEAD matches its pre-task value" (not "no files changed" / "no new commit": git status --porcelain omits ignored files, and equal HEADs do not rule out a commit that was later reset). The failed-abort path reports its outcome too.
5. Sender notices are attempts. notify swallows a failed signed-mail send and the mail is then acknowledged, so text must say the runtime attempts to notify the sender (or the notice is made durable before acknowledgement); test a send failure.
6. Doc. The mail task block's "(same as Flair task path)" comment is over-broad (the mail path checks rebase state and changes first); state the mail-specific checks.

Refs #781, #784.