feat: advance tested Codex CLI to official rust-v0.144.4

[rldyourmnd]

Vendor-currentness follow-up: the new observation lane caught rust-v0.144.4 (published 2026-07-14, vendor-declared "No user-facing changes in this patch release") the same day.

• All pins advanced 0.144.3 -> 0.144.4: build/version.json, VERSION 0.3.3, manifest + nddev-contract mirrors, runtime TESTED_CODEX_VERSION, baseline evidence URLs, builder config-schema source link.
• Artifact identity derived, not copied: install.sh byte-identical to 0.144.3 (size 25133, sha256 1154e9da...); codex-package_SHA256SUMS digest 09e949a0...; all four platform package digests taken from the digest-verified sums file.
• Live proof on an isolated target: install-cli downloaded, verified and installed 0.144.4 (software-status current=true); full setup lifecycle (apply safe -> switch full-auto -> restore -> remove) re-passed.
• Pending evidence rebound to the 0.3.3 content digest.

All commits SSH-signed.