ci: pin mock tools in one file, bump to claude 2.1.283 and codex 0.157.1

Pins
- scripts/mock-tools.pins is the single source: install-mock-tools.{sh,ps1},
  tests/support/pins.rs and the CI cache key read it. The scripts also take a
  bare tool name (codex, claude) resolved against it.
- The install fast path compared the whole --version output to the bare
  version (`2.1.283 (Claude Code)` != `2.1.283`), so every run and every CI
  cache hit reinstalled. Match a version token instead (~70s -> <1s).

Test harness for the new versions
- Codex: mark gpt-5.5's model migration as seen (startup "Try new model"
  modal); answer the hidden thread-title request and don't count it as a turn.
- Claude: the trust dialog now preselects "No, exit", so drivers move onto
  the accepting option before Enter; the approval test requests manual mode,
  since sessions behind a gateway now default to auto mode.

CI and justfile
- Cancel superseded runs per ref (not main, not dispatched repeat hunts).
- Patch bumps: setup-node 6.5.0, cache 5.1.0, rust-cache 2.9.2, Node 22.23.3,
  actionlint 1.7.12 (drops the now-unneeded macos-15-intel ignore).
- `just mock-tools` has the same name on Windows; `just ci <steps>`
  validates step names before running anything (bash and PowerShell).