Fix codex subagent indexing, search cwd, and broken-pipe exits

[caffeinum]

Three reported bugs, plus the test failures that were blocking the verification gate.

1. Codex subagents failed to index behind their parent

[6/10] error 9767dfaf (...): FOREIGN KEY constraint failed
[7/10] error 1abb4461 (...): FOREIGN KEY constraint failed
[8/10] error 0cd2d771 (...): FOREIGN KEY constraint failed
[9/10] indexed 4105a92a (...)

All three are subagents of 4105a92a — indexed at position 9, after its own
children. Discovery is newest-first and a fork always starts after the session
that spawned it, so children reached the indexer first; sessions.parent_id is
a foreign key, so the insert aborted and the session was dropped entirely.

• Discovery sorts linked sessions after their potential parents (the existing
  Hermes-only rule, generalized — Codex needed it for the same reason).
• The indexer writes the link only when the parent row exists.
• Anything still unresolved is applied after the pass, which also covers nesting.
• A parent that is never indexed leaves the child indexed and typed as a
  subagent with the link unset, and says so:
  -> session 9767dfaf: parent 4105a92a is not indexed; link left unset

Losing the whole session to keep a foreign key was the wrong trade.

2. gaal search did not report cwd

A hit named the session but not where it ran, so getting back to the repo took a
second inspect per session. The enrichment pass already loads the session row;
cwd now rides along in JSON and in the -H table.

3. gaal ... | head reported a failure

{"error":"The command failed: Broken pipe (os error 32)", ... "exit_code":1}

Rust ignores SIGPIPE at startup, so a closed downstream pipe surfaced as an
EPIPE write error — an error payload and non-zero exit for JSON commands, a
println! panic for human output. Gaal now restores the default disposition and
dies on SIGPIPE (141) with clean stderr, like every other CLI.

Test failures that were already red on master

cargo test fails on master before any of the above:

• handoff_frontmatter_uses_local_date hardcoded the local date of a 23:43 UTC
  timestamp — true only at UTC+1 or east, false in US timezones.
• The agy batch-handoff and grok search tests used a relative --since 30d (or
  the search default) against fixtures with fixed dates, and those fixtures aged
  past the window. Pinned to absolute bounds, matching the surrounding agy
  assertions.

Verification

• New tests/integration/codex.rs with a sanitized fixture (coordinator +
  two subagents + one subagent whose parent has no trace). Each test was
  confirmed to fail with the fix reverted and pass with it.
• cargo fmt --check, cargo clippy --all-targets, cargo test (203 tests),
  ./tests/run-all.sh — all green.
• Checked against the real traces that produced the report: the same window that
  gave "errors": 3 now indexes 9/9 with the three subagents linked to
  4105a92a and that parent promoted to coordinator.

Opened from a fork — the account on this machine has read-only access to
buildoak/gaal.

🤖 Generated with Claude Code