Preserve renamed thread titles during reconciliation (#25624)

## Summary
- preserve existing explicit SQLite thread titles during rollout
reconciliation/backfill when the incoming rollout title is only
first-message-derived
- keep stale inferred-title repair behavior while avoiding session-index
scans during startup backfill
- add a regression test for renamed titles surviving reconcile

## Testing
- just fmt
- just test -p codex-rollout
- just test -p codex-state

codex-rs/state/src/model/thread_metadata.rs

@@ -239,6 +239,21 @@ impl ThreadMetadata {
         }
     }
 
+    /// Preserve an existing user-facing title when reconciling rollout-derived metadata.
+    pub fn prefer_existing_explicit_title(&mut self, existing: &Self) {
+        let existing_title = existing.title.trim();
+        if existing_title.is_empty()
+            || existing.first_user_message.as_deref().map(str::trim) == Some(existing_title)
+        {
+            return;
+        }
+
+        let title = self.title.trim();
+        if title.is_empty() || self.first_user_message.as_deref().map(str::trim) == Some(title) {
+            self.title = existing.title.clone();
+        }
+    }
+
     /// Return the list of field names that differ between `self` and `other`.
     pub fn diff_fields(&self, other: &Self) -> Vec<&'static str> {
         let mut diffs = Vec::new();