Surface codex error envelopes instead of bare 'exit status 1'

When a codex review fails, codex writes the reason as a stdout JSON envelope (type error/turn.failed) and exits non-zero with empty stderr. The parser dropped these, leaving only 'exit status 1'. Capture the message (flat 'message' or nested 'error.message') and emit it as a RunError when the turn never completes, so the real cause shows in the dump and TUI detail.