Add companion hardening, MCP diagnostics, and Fable alias

[CBEPX]

Summary

• add $cc:transfer for importing Claude transcript history into a resumable Codex thread
• add explicit review MCP opt-in and $cc:mcp-diagnose for Claude MCP visibility without exposing server secrets
• track Claude model fallback events, classify usage-limit failures, and harden foreground task/review handling
• add the fable model alias (claude-fable-5[1m]) and release metadata for v1.3.0
• add advisory Stryker mutation testing and focused tests for the first baseline lift
• fix false Claude usage-limit summaries for successful outputs that mention rate limiting/429 handling, including exit-zero unknown turns with parse-error noise
• avoid usage-limit summaries for failed turns whose final model output only discusses 429, rate-limit handling, or quoted limit prose without Claude's terminal limit signal
• scope Claude usage-limit reset extraction to the latest terminal limit signal so unrelated resets prose and quoted canonical epoch fixtures do not leak into retry text
• suppress noisy Fable [1m] terminal-model fallback warnings when Claude reports the equivalent bare model id
• preserve detached worker stdout/stderr in job logs so auto-reaped failures keep useful diagnostics

Validation

• npm audit: 0 vulnerabilities
• npm run check
  • unit: 541/541
  • integration: 69/69
  • e2e: 22/22
• npm run test:mutation:force
  • total mutation score: 56.00%
  • claude-cli.mjs: 47.61%
  • render.mjs: 59.38%
  • args.mjs: 84.77%
  • structured-output.mjs: 80.41%
• git diff --check: clean
• Fable adversarial review on final delta ebc1927..b78145d: approve, no material findings
• GitHub checks on PR head b78145d: Hawkman secrets scan SUCCESS, Semgrep SUCCESS

License / attribution

• Preserves Apache-2.0 licensing.
• Keeps the existing LICENSE and NOTICE attribution, including Sendbird and OpenAI notices.