Sanitize Codex transcripts on the compact finalize path

The initial-write path (writeTranscript) sanitizes Codex transcripts via codex.SanitizePortableTranscript before compaction, but the finalize path (replaceTranscript) passed raw bytes to writeCompactTranscript. Because sanitization drops compaction/encrypted lines, the checkpoint-scoped compact (sliced by StartLine) diverged from the initial write for Codex after UpdateCommitted.

Sanitize the compact's input on the finalize path so it matches the initial write. The sanitization runs exactly once per path — the initial path already passes sanitized bytes, so writeCompactTranscript no longer re-sanitizes.

Addresses Cursor Bugbot "Codex sanitize skipped on finalize".