fix(orgtrack): verify Codex hooks on session start

[VantaNode]

Summary

• install SessionStart as a required Codex provenance hook, even when live status is disabled, so a trusted hook set verifies as soon as the Codex session starts
• rename the ambiguous awaiting_approval state to awaiting_verification and keep the 2-second receipt polling while that state is visible
• remove the fixed three-hook assumption and provide complete localized verification copy across all 13 supported locales
• exercise the real app-binary SessionStart receipt path in the rendered WebDriver flow

Why

Codex trusts the exact hook definition, but ORG2 deliberately requires proof that the installed definition actually executed. Previously, the first guaranteed verification callbacks were PostToolUse or subagent lifecycle events, so choosing Trust all and continue could leave the UI showing “Needs approval” until the next tool call. SessionStart closes that gap without recording any fake file interaction.

Codex hook lifecycle reference: https://learn.chatgpt.com/docs/hooks

Verification

• cargo test --manifest-path src-tauri/Cargo.toml -p agent_cli session_provenance --lib — 33 passed
• pnpm typecheck
• targeted ESLint — passed
• session-provenance RPC schema tests — 7 passed
• full agentOrgs.sessionProvenance i18n completeness check — 13 locales passed
• isolated rendered WebDriver scenario centralizes hook capture settings in Launchpad Runtime — 1 passed; opens the native Codex trust prompt and verifies SessionStart receipt → active UI
• pre-commit agent_cli clippy — passed