Gate TUI deliver on Codex instructions refresh

[TheGreatAxios]

Problem

src/tui/runner.ts fired refreshCodexInstructions() fire-and-forget
(void refreshCodexInstructions().catch(...)), two network fetches deep
(src/auth/codex/instructions.ts), mutating the module-level instructions
singleton. codex-responses-adapter.ts places that singleton at the top of
every request body. When the refresh resolved after inference #1 started,
turn #2's entire request prefix changed underneath it, guaranteeing one
full provider prompt-cache miss per session at a nondeterministic point.

src/exec/runner.ts already awaits the refresh before building its first
request; only the TUI raced it.

Fix

Chose "gate only the first request on the promise settling" over blocking
TUI startup on a network fetch, since the TUI has other useful startup work
(menus, banners, etc.) that shouldn't wait on a Codex-specific refresh, and
non-Codex profiles shouldn't pay for it at all.

• Moved the Codex/xAI profile detection above the delivery queue in
  runner.ts and captured the refresh as a held Promise<void>
  (codexInstructionsRefreshed), resolved immediately for non-Codex
  profiles.
• enqueueAgentDeliver — the single choke point both live delivery paths
  (requestContinuation and the main input path) go through — now awaits
  that promise via a new optional ready param on
  deliverAgentMessage, before it checks for a fatal build error or calls
  deliverToLiveAgent.
• The existing .catch fallback is preserved: a failed refresh still lets
  the session proceed on cached/bundled instructions instead of throwing.

Because every deliver — not just the first — awaits the same already-settled
promise, later turns pay no cost, and the first request can never observe a
mid-flight swap of the instructions value.

Test

Added two cases to deliver-agent-message.test.ts:

• delivery holds until ready settles, and the value observed at delivery
  is the post-refresh one — i.e. the swap happens before the first request
  is built, not after — matching the "first request waits for it" behavior
  chosen here.
• delivery proceeds immediately when ready is already settled (steady
  state after turn 1).

Gates

• bunx prettier --check / bunx eslint clean on all touched files except
  runner.ts, which already fails prettier on main before this change
  (pre-existing, repo-wide, unrelated) — confirmed via git stash diff, and
  eslint produces the identical 16 pre-existing errors on runner.ts with
  or without this change.
• bun run typecheck, bun run build pass.
• bun test ./src ./tests ./evals: 5115 pass, 1 fail (lsp-availability.test.ts,
  environment-only — fails identically on main before this change, missing
  typescript-language-server in this checkout).

Fixes CL-6907

[linear-code]

CL-6907