[codex] Add CWF closeout verification gates

[enderzcx]

Summary

• Add checker-owned verified state and failure-to-regression semantics to CWF docs, skill contract, run-plan template, generated run plans, and safe-fix-loop workflow guidance.
• Add verified_state and failure_to_regression placeholders to initialized CWF run state and return envelopes.
• Add a closeout_gate in cwf-return-envelope.mjs so completed runs are downgraded when checker-owned verification is missing or a required regression lock has neither artifact nor skip reason.

Context

This PR wires the EWC v0.2.5 delta into the codex-workflows repo. The global EWC file at /Users/sunny/Work/CC/OPC/ENDER_WORK_CONTRACT.md was updated locally and is outside this repository.

Review Notes

• Reasonix scoped review review-mqemelg5-7sb361: GO, no blocker/high; noted a medium closeout-gate follow-up.
• Reasonix follow-up review review-mqemi3ta-izb58i: GO, no blocker/high after the closeout gate patch.

Validation

• npm run check
• node scripts/cwf-skills.mjs validate codex-workflows --format markdown
• python3 skills/codex-workflows/scripts/check_skill_install.py --check-install
• python3 /Users/sunny/.agents/skills/sunny-meta-skill/scripts/check_sunny_skill.py skills/codex-workflows --allow-repo-docs
• git diff --check
• git diff --cached --check