cancel without a job id can cancel another Claude session's hidden running task

[VOIDXAI]

Summary

/codex:status without a job id is scoped to the current Claude session, but /codex:cancel without a job id is not. In a multi-session workspace, the current session can see running: [] and still cancel a different session's active background task.

Reproduction

1. Create plugin state for a repository with one active task owned by Claude session sess-other.
2. In a separate Claude session sess-current, run:
   • node scripts/codex-companion.mjs status --json
   • node scripts/codex-companion.mjs cancel --json
3. Observe that status reports no running jobs for sess-current, but cancel succeeds and marks the sess-other job as cancelled.

Expected

• Default cancellation with no explicit job id should be session-aware, just like /codex:status.
• If the current session has no active jobs, cancel should fail with a current-session-specific message instead of mutating another session's task.
• Explicit cancel <job-id> can still remain a precise cross-session override.

Actual

• status --json shows running: [] for the current session.
• cancel --json still cancels the other session's running task and rewrites persisted state to cancelled.

Suspected Cause

resolveCancelableJob(...) filters active jobs by status only. It ignores CODEX_COMPANION_SESSION_ID unless the caller passes an explicit job id.

Suggested Fix

Apply current-session filtering only for the implicit "cancel the default active task" path, while preserving the existing explicit job-id behavior for precise cancellation.