fix: reject signal-killed helpers, create custom codex-home, and clean temp output on failure

[Alphaxiaoteng]

Summary

1. Rejects signal-terminated helper commands in drop-sudo (Fixes drop-sudo treats signal-terminated helper commands as successful #152): Previously, code ?? 0 treated child processes terminated by signal (code === null) as successful exits (code 0). Now signal termination explicitly rejects with an error containing the terminating signal name/code.
2. Ensures custom and environment codex-home directories exist before proxy startup (Fixes Custom codex-home fails when the target directory does not exist yet #135): Pre-creates custom codex-home directories (with sudo -u <codex-user> under unprivileged-user strategy or fs.mkdir otherwise) so proxy and server-info creation do not fail due to missing parent directories.
3. Always cleans up action-created temporary output directories on failure (Fixes Failed Codex runs can leave temporary output directories behind #137): Moved cleanupTempOutput() into the finally block of runCodexExec(), ensuring that temporary output directories created for --output-last-message are cleaned up when Codex fails or exits non-zero, rather than being abandoned on runner disk.

---

Changes

• src/dropSudo.ts:
  • Handled (code, signal) event in execCommand(). If code === null, rejects with a descriptive signal error unless ignoreFailure is set.
• src/main.ts:
  • Updated resolveCodexHome() to create custom inputCodexHome and envHome paths before returning them.
• src/runCodexExec.ts:
  • Moved cleanupTempOutput(outputFile, runAsUser) into the finally block of runCodexExec().
• test/cleanupAndCustomHome.test.mjs:
  • Added unit test verifying resolve-codex-home creates non-existent custom directory structures.
  • Added regression test verifying implicit temporary output directory is deleted even when Codex exits with code 1.

---

Verification

• npm run build cleanly compiled with esbuild.
• npm test passed: 146/146 tests passing.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[Alphaxiaoteng]

recheck