[codex] Fix first message timestamp edge cases

[armand0e]

Summary

• Exclude Claude Code tool-result type: "user" events from metadata.first_message_timestamp selection.
• Prefer nested payload.timestamp / message.timestamp over event envelope timestamps when both exist.
• Add regression coverage for the two Codex review comments on [codex] Add first message timestamp metadata #4.

Why

The automated review on #4 caught two timestamp edge cases after merge:

• Claude Code tool-result events are encoded as type: "user", but convert to role: "tool", so they should not be treated as user-message timestamps.
• Pi/OpenClaw events may contain both an envelope timestamp and nested message.timestamp; the nested timestamp is the per-message value promised by the metadata docs.

Follow-up to #4.

Validation

• uv run pytest tests/test_converter.py -> 34 passed
• uv run pytest tests/test_converter.py tests/test_loader.py tests/test_trace_readme.py -> 59 passed
• uv run pytest -> 344 passed, 21 skipped
• uv run ruff check . -> passed
• git diff --check -> passed
• uv build -> built sdist and wheel for 0.1.3
• uv pip check -> all installed packages compatible
• uv run python -m compileall -q src tests -> passed
• Example trace smoke for examples/example_claude_code.jsonl, examples/example_codex_session.jsonl, and examples/example_pi_session.jsonl -> passed
• Current HF Datasets source-path integration smoke using datasets.packaged_modules.json.Json(features=AGENT_TRACES_FEATURES) -> passed for Claude tool-result, Pi nested timestamp, and OpenClaw nested timestamp cases
• Live smoke: load_traces("cfahlgren1/openclaw-test") returns metadata.first_message_timestamp == "2026-02-16T23:40:43.795000Z", confirming the nested OpenClaw message timestamp wins.