test+docs: codex probe cache invalidation coverage, make-pdf --no-* structural pin, file the review-batch deferrals

- test/codex-model-probe.test.ts: the 1h TTL and the auth.json half of the
  mtime signature had no coverage — a regression in either would silently
  serve a stale MODEL_OK after re-login or forever. Added TTL-expiry
  (backdated cache line re-probes) and auth.json-mtime invalidation cases,
  mirroring the existing config.toml case.
- make-pdf/test/cli-args.test.ts: structural assertion derived from the
  commands.ts registry — every --no-* flag must be in BOOLEAN_FLAGS, so a
  new negation flag can't silently re-open #2514 (swallowing the next
  positional).
- TODOS.md: filed five review-batch deferrals under the v1.67 queue with
  rationale and effort: setup host-function dedup, cmd.exe %VAR% quoting in
  gbrainInvocation (cross-spawn direction), make-pdf flag registry metadata
  (derive BOOLEAN_FLAGS), legacy codex/factory/kiro uninstall provenance
  gating (parity with the cursor gate), and cursor auto-detect breadth
  (product call).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/codex-model-probe.test.ts

@@ -164,6 +164,42 @@ describe('codex model probe (#2477)', () => {
     }
   });
 
+  test('TTL expiry: a cached MODEL_OK older than 3600s re-probes (T5)', () => {
+    const f = makeFixture();
+    try {
+      runProbe(f, 'ok');
+      expect(invocations(f)).toBe(1);
+      // Backdate the cache line's timestamp past the 1h TTL, keeping the
+      // signature valid — TTL alone must force the re-probe.
+      const cachePath = path.join(f.gstackHome, '.codex-model-probe');
+      const [status, ts, sig] = fs.readFileSync(cachePath, 'utf-8').trim().split(' ');
+      expect(status).toBe('MODEL_OK');
+      fs.writeFileSync(cachePath, `MODEL_OK ${Number(ts) - 3700} ${sig}\n`);
+      const r = runProbe(f, 'ok');
+      expect(r.stdout.trim()).toBe('MODEL_OK'); // not "(cached)"
+      expect(invocations(f)).toBe(2); // re-probed
+    } finally {
+      fs.rmSync(f.home, { recursive: true, force: true });
+    }
+  });
+
+  test('auth.json mtime change invalidates the cached MODEL_OK (T5: re-login re-probes)', () => {
+    const f = makeFixture();
+    try {
+      runProbe(f, 'ok');
+      expect(invocations(f)).toBe(1);
+      // A re-login rewrites auth.json; the mtime signature must invalidate
+      // the cache even though config.toml is untouched.
+      const future = Date.now() / 1000 + 10;
+      fs.utimesSync(path.join(f.codexHome, 'auth.json'), future, future);
+      const r = runProbe(f, 'ok');
+      expect(r.stdout.trim()).toBe('MODEL_OK');
+      expect(invocations(f)).toBe(2); // re-probed
+    } finally {
+      fs.rmSync(f.home, { recursive: true, force: true });
+    }
+  });
+
   test('config.toml change invalidates the cached MODEL_OK', () => {
     const f = makeFixture();
     try {