fix: gate codex skip-git flag and harden continue validation

[avifenesh]

Summary

• replace hardcoded Codex skip-git usage with conditional {SKIP_GIT_FLAG} templates
• document deterministic trust-gate resolution (trusted git repo => empty, trusted non-repo => --skip-git-repo-check)
• require explicit substitution of {SKIP_GIT_FLAG} and forbid inherited env-based expansion
• harden --continue restore guidance with strict re-validation for tool, session_id, and model
• strengthen regression checks to pin conditional behavior and prevent hardcoded skip-git regressions

Validation

• npm test
• npm run validate