fix(reward-memory): accept bounded Codex App reflections - #4875

Summary

• replace the obsolete 2,400-character whole-reflection limit with a 16 KiB UTF-8 transport bound
• retain the existing field-level public-safety and procedural-experience validation
• keep valid large reflections without an exact Todo validator in awaiting_evidence_validation with zero provider writes
• preserve fail-closed behavior for truly oversized packets

Validation

• uv run --project . --with pytest python -m pytest -q tests/capabilities/test_reward_memory_codex_app_outcome.py tests/capabilities/test_reward_memory_outcome_lifecycle.py (15 passed)
• uv run --project . --with ruff ruff check loopx/capabilities/reward_memory/outcome_lifecycle.py tests/capabilities/test_reward_memory_codex_app_outcome.py
• git diff --check

Product surfaces

This is a shared Codex App staging-contract correction. No frontend or Lark control changes are required: the existing public receipt shape remains unchanged, and the affected path is the pre-provider private staging decision used by the Codex App refresh/spend flow.