Codex reconnect collides with an SSH OAuth tunnel

Symptom. Remote restart or reconnect logs report a callback port already in use, sometimes alongside mux session refused.

Root cause. A persistent SSH connection owns a LocalForward, while a separate app-managed SSH connection tries to bind that same port. MCP refresh warnings after reconnect are a separate result of initializing enabled servers.

Fix. Keep callback forwarding on a dedicated workstation-oauth alias with its own ControlPath; keep the ordinary app workstation alias free of callback forwards. See MCP login from SSH. Existing SSH masters retain their original forwards until closed. A task marked interrupted also needs its own event timeline: received interrupt requests, transport failures, and MCP authentication errors are distinct events.