feat(cli): sanitize replay-unsafe reasoning items before native Codex replay and on restore