codex auto-commit: the commit helper's second git status probe fails closed #824

Follow-up from the adjudication of #810. In the commit helper (codex-runtime.ts ~:596) the second git status probe's failure is ignored, so after the gate decision the helper can enter its existing-commits path without having confirmed the working-tree state. The fix treats a failed second probe as a refusal with an error naming the repository and the probe's exit status and stderr, with a test that makes the probe fail and asserts no commit is attempted.

Refs #800, #810