Fix primary runtime inspection without confirmation prompts

[tatsuhitofuruta]

Summary

• Add a focused --primary mode that inspects the exact current rollout through CODEX_THREAD_ID.
• Read the latest turn_context, require and emit its lowercase-UUID turn_id, and use that identified turn's model and effort as the applied runtime evidence.
• Require exact gpt-5.6-sol / high evidence while preserving the existing auxiliary inspector contract and fail-closed behavior.
• Explain that a reasoning-level change made in the UI during a running turn becomes runtime evidence only after Codex starts and records the next turn.
• Replace repeated manual confirmation with automatic primary-session evidence.

Why

Sol Advisor 0.6.0 falls back to asking the user for Sol / High confirmation when host metadata is not exposed, even though Codex records the applied model and effort in each thread rollout. The existing auxiliary runtime inspector rejects primary sessions because they do not contain auxiliary-only agent_role metadata.

A live reproduction also showed an important turn boundary: selecting High in the UI while a Medium turn is already running does not retroactively change that turn. The rollout continues to report Medium until the next turn starts. Returning the validated latest turn_id makes the inspected model and effort attributable to one applied turn instead of to the task in general.

This PR isolates the root-session runtime inspection fix for #25. The advisory hook and configuration UX proposed in #26 can be evaluated independently.

Verification

• sh plugins/sol-advisor/scripts/verify.sh
• git diff --check
• Medium-to-High fixture selects the latest turn and returns its exact turn_id with effort: high.
• Missing or malformed current-turn IDs, missing effort, model mismatch, and auxiliary-role evidence fail closed.
• Prompt, transcript, historical working directory, and auxiliary-only fields remain outside the primary output allowlist.

Fixes #25