Fix false max-turns detection in Codex output

[danii1]

Summary

Same class of false positive as #15 (usage-limit detection). DEV-70's Codex run finished the Turborepo work, then DevIntern classified it as max-turns exhaustion because the detector substring-matched this repo's own source and oxlint dumps (due to max turns reached...).

• require Claude's Error: Reached max turns (N) (and close variants) to match a complete diagnostic line, not an arbitrary transcript substring
• skip scanning for harnesses that cannot pass --max-turns (today only Claude Code sets supportsMaxTurns)
• do not treat stderr as trusted; Codex writes its tool transcript there, which is why stderr-only would not have prevented DEV-70
• share source/diff/search-line filtering with the usage-limit detector
• log the matched line when a run is classified as max-turns

Why not stderr-only

#15 already rejected "stderr is diagnostic." Codex exec dumps command/tool output on stderr. The DEV-70 false positive lived in that transcript.

Verification

• focused detector + harness tests: passed
• pre-commit format, lint, and typecheck: passed