Preserve tool provenance and Desktop callback ownership

[jibanez-staticduo]

Bridge-originated instructions were sent as user text, and unsupported-method replies could consume the shared callback before Desktop handled it. This change sends create, worktree-create, and follow-up instructions through turn/start.toolOutput, preserving the bridge tool name and namespace.

The bridge leaves server-initiated client actions unanswered and keeps its shared connection open after dispatch, so pending reads are not disconnected. steer_thread, permission behavior, and durable mutation receipts retain their existing behavior.

Callback behavior

Codex 0.153.4 shares callback state across subscribers and consumes it on the first response or error (upstream source). Another capable client must be subscribed to handle these requests; silence does not establish a Desktop subscription or provide interactive approvals.

Validation

• 126 tests pass, including concurrent-read regressions for all three dispatch paths and two-client callback tests.
• The new concurrent-read regressions fail on the previous PR revision with TransportError: App Server disconnected.
• Ruff lint/format, type checks, and source/wheel builds pass.
• Combined with the companion PR: clean merge, 136 tests pass, and lint/format/type/build checks pass.
• Tests use fake App Servers. No live model session was created; Desktop callback handling was checked against upstream source and simulated subscribers.

Independent of #5, which adds the portable proxy transport.

[saidelike]

Thank you