fix(exec): return non-zero when shell command fails

[middleDuckAi]

Summary

• mark codex exec as failed when the active task receives ExecCommandEnd with Failed or Declined
• keep the change scoped to the existing exec-session failure accounting
• add a regression test proving a false shell command returns exit code 1

Why

• the exec rollout can currently exit 0 even when the shell command itself finished non-zero

Testing

• CARGO_TARGET_DIR=/tmp/codex-target-15536 cargo test -p codex-exec exits_non_zero_when_shell_command_finishes_failed -- --nocapture
• just fix -p codex-exec
• CARGO_TARGET_DIR=/tmp/codex-target-15536 cargo test -p codex-exec