Add Apex agent integration and harden matched campaigns

[irvineoy]

Summary

• register Apex as an AgentKernelArena agent without adding an AKA adapter to Apex
• preserve AgentKernelArena as the only central compiler, correctness, performance, and score authority
• add matched Apex-vs-direct-Codex campaign configs, deterministic GPU assignment, process isolation, GPU exclusivity, and immutable evidence receipts
• harden Apex receipt v2 with sealed TaskSpec/original prompt/event-bound inner prompt, exact caller run control, verifier interpreter/argv binding, journal/transcript lineage, and process cleanup evidence
• keep no_gain and failed/diagnostic baseline replays out of candidate selection
• retain valid budget_exhausted lineage while requiring an outer failure and exact structured-turn reason/count evidence
• bind receipt type to the sealed campaign manifest before dispatch, rejecting Apex/Direct-Codex receipt substitution and v2-to-v1 downgrade
• require the actual prompt_sent ContextPacket role.objective to equal the sealed TaskSpec instructions, including formal run control

Matched GPU evidence

The matched GPU campaign was run at AgentKernelArena commit 73a4db29, before the final post-campaign hardening commit in this PR.

• Direct Codex control: 5/10 canonical tasks, score 1699.842135, average task score 169.984214, average speedup 2.199684x, median speedup 1.232776x
• Apex treatment: 0/10 canonical tasks; all 30/30 inner Codex sessions exhausted the 50-turn budget (14 stopped at 50 before a required follow-up, 16 were observed at 51)
• comparison report SHA-256: 665eac439d0baa626172ad9e6255c218486b9fccf8e6a42adaee05ccda578807

Local evidence roots:

• /data/viouyang/apex/aka/workspace_MI355X_codex/run_20260807_183834_codex_baseline_v5r2
• /data/viouyang/apex/aka/workspace_MI355X_apex/run_20260807_192006_apex_treatment_v5r2
• /data/viouyang/apex/aka/comparisons/codex_vs_apex_v5r2.txt

This PR does not claim that the post-campaign hardening was rerun as a new matched GPU pair. The result is diagnostic: Apex found promising candidates internally but did not converge/freeze a deliverable before the turn boundary. Convergence checkpoints, early best-candidate freeze, reserved verification budget, and knowledge routing are Apex-core follow-up work, not AgentKernelArena adapter behavior.

Verification

docker run --rm --user "$(id -u):$(id -g)" \
  --security-opt seccomp=unconfined --security-opt apparmor=unconfined \
  --entrypoint /bin/bash -e PYTHONDONTWRITEBYTECODE=1 \
  -v /usr/bin/bwrap:/usr/bin/bwrap:ro \
  -v "$PWD":/workspace:ro -w /workspace \
  lmsysorg/sglang-rocm:v0.5.14-rocm720-mi35x-20260705 \
  -lc 'python3 -m pytest -q -p no:cacheprovider tests'

• 328 passed
• focused Apex/campaign suite: 124 passed
• all 30 historical Apex treatment prompts were rechecked against their sealed TaskSpec instructions with the new canonical ContextPacket objective validator
• two independent final diff reviews found no remaining release blocker