fix(risk-scorer): normalize Codex agent targets

[tompahoward]

Summary

• normalize canonical /root/name and relative name Codex completion targets at the shared state-key boundary
• retain checkout-bound receipt binding, atomic dedupe, and silent completion behavior
• adapt the existing direct-interrupt regression

Verification

• npx bats packages/risk-scorer/hooks/test/codex-agent-completion.bats (23 passed)
• npx bats --recursive packages/risk-scorer/hooks/test (233 passed)
• npx bats packages/shared/test/risk-scorer-codex-plugin.bats (9 passed)
• Codex/plugin manifest, agent-instruction, syntax, and diff checks passed
• final architecture review: PASS; no new ADR
• pipeline risk: commit=4, push=4, release=4