fix: enable message routing to driver-managed Codex slots without peer_id

- Add pollBySlot broker endpoint: queries messages by to_slot_id instead
  of to_id (peer_id). Driver-managed Codex agents have no peer_id since
  the adapter doesn't register with the broker.

- Update handleSendMessage: allow messages to slots without peer_id by
  using __slot_N__ virtual target. Messages stored with to_slot_id set.

- Update orchestrator forwarding loop: use pollBySlot instead of
  pollMessages for CodexDriver-managed agents.