Improve SDK evolution agent safeguards

[ebarti]

Summary

Splits the SDK evolution example/tooling fixes away from the generated SDK update run.

This PR contains only changes to the local SDK evolution example, its docs, and tests. It intentionally excludes generated report artifacts and lockfile updates.

Changes

• Requires candidate API diffs for resolver-selected SDK update candidates before implementation can proceed.
• Makes candidate inspection effectively always-on for update candidates while keeping the CLI flag for compatibility.
• Adds a detailed design document for the SDK evolution agent flow, evidence layers, behavior probes, changelog strategy, gates, baseline promotion, caveats, and alternatives.
• Documents artifact-aware API inspection and current-state baseline promotion.
• Applies the Codex-backed SDK evolution model policy: gpt-5.5 with reasoning_effort=xhigh, scoped only to codex-agent-sdk.
• Keeps CODEX_HOME=~/.codex_agent_runtime_sdk isolated for SDK evolution runs.
• Adds tests for the candidate diff guard, resolver-target snapshotting, Codex home isolation, and Codex model/effort metadata.

Verification

• env -u UV_EXCLUDE_NEWER uv run ruff check .
• env -u UV_EXCLUDE_NEWER uv run mypy
• env -u UV_EXCLUDE_NEWER uv run pytest (100 passed, 3 skipped)

Safety

• No dependency lockfile changes in this PR.
• No generated SDK update report artifacts in this PR.
• No unsupported credential scraping.
• No auto-merge.