fix(codex): do not time out unread pongs while websocket reads are paused #25

Downstream backpressure pauses WebSocket reads, including pong frames, while the old heartbeat continues judging elapsed time. Reproduced: a healthy locally paused upstream is terminated as pong_timeout. Skip heartbeat checks and pings during read pause, grant fresh pong grace on resume, retain response timeout/cancellation and genuine missing-pong checks. Add credential-safe close diagnostics (cause, timing, pause/output state, code and hashed reason only). No replay after exposed output or manufactured successful completion. OMP-authored patch, independently reviewed: baseline regression 2 pass/3 fail; after 20/20 focused tests and typecheck; full suite 210 pass/0 fail/2 cancelled. Both cancellations reproduce on pristine main in upstream-errors.test.ts. This establishes a source bug, not the exact live alert cause; deployed route/revision and correlated close metadata remain needed. No deployment.