Why

thread/rollback is deprecated, but the TUI still used it for transcript time travel and for restoring a prompt when a turn was interrupted before visible model output. The warning suppression in #30124 was only a compatibility bridge: destructive rollback still rewrote the source thread and coupled two different interactions to an API that is going away.

This change moves transcript time travel to inclusive session forks and restores interruption to normal transcript semantics: preserve what the user submitted, show that the turn was interrupted, and leave a fresh composer.

What Changed

• Replace the TUI's rollback RPC, pending state, local transcript trimming, and prompt-restoration plumbing with thread/fork through the selected completed turn.
• Keep the source thread unchanged, attach the new fork, and open it with a blank composer.
• Add additive v2 Turn.isForkable metadata so the TUI only offers persisted canonical turn boundaries; legacy synthetic history remains visible but is never sent as lastTurnId.
• Persist regular-turn TurnStarted and the transcript-only user item across very early interruption, while keeping an interrupted or hook-blocked prompt out of model-visible history.
• Move faster-model safety retries onto a source-preserving branch through the immediately preceding canonical turn, or a fresh thread for a true first turn. Legacy synthetic predecessors fail safely instead of dropping context.
• Preserve the completion cleanup landed in fix(tui): clear completed safety buffering prompt #30490 and make retry prompt rendering transactional so a rejected turn/start cannot leave a ghost transcript row.

The deprecated app-server thread/rollback endpoint remains available for other clients; this PR removes its TUI consumers.

How to Test

1. Start the TUI with just codex from codex-rs and complete at least two turns.
2. Open the transcript with Ctrl+T, press Esc to enter fork selection, move to an older completed turn, and press Enter.
3. Confirm the TUI switches to a new thread containing history through the selected turn, the composer is blank, and the original thread is still intact when resumed.
4. Submit another prompt and press Esc or Ctrl+C before any assistant output.
5. Confirm the submitted prompt remains in the transcript, the normal interruption message appears, and a blank composer opens for the next prompt.

Focused regression coverage:

• just test -p codex-tui safety_buffer
• just test -p codex-core interrupting_regular_turn_waiting_on_startup_prewarm_persists_user_item
• just test -p codex-app-server thread_shell_command_history_responses_exclude_persisted_command_executions
• just test -p codex-app-server-protocol

The protocol suite passed 251/251. Full affected-crate runs left only known local-environment failures: two Guardian tests that also fail on the unchanged base, three app-server tests requiring unavailable local binaries, and four core tests dependent on sandbox/MCP environment state.