Fix /review interrupt and TUI exit wedges (#18921)

Addresses #11267

## Summary
`/review` can be interrupted while it is still spawning the review
sub-agent. That spawn path lives in `codex-core` and did not observe the
task cancellation token until after `Codex::spawn` returned, so an
interrupted review could keep building a child session and leave the TUI
in a wedged state.

The TUI exit path also waited indefinitely for app-server
`thread/unsubscribe`, which made Ctrl+C look broken if the app-server
was already stuck. This makes interactive delegate startup
cancellation-aware and bounds the TUI shutdown-first unsubscribe wait
with a short UI escape-hatch timeout.

## Testing
I reproed the hang using the steps in the bug report. Confirmed hang no
longer exists after fix.

codex-rs/tui/src/app/event_dispatch.rs

@@ -5,6 +5,8 @@
 
 use super::*;
 
+const SHUTDOWN_FIRST_EXIT_TIMEOUT: Duration = Duration::from_secs(/*secs*/ 2);
+
 impl App {
     pub(super) async fn handle_event(
         &mut self,
@@ -1656,7 +1658,20 @@ impl App {
                 self.pending_shutdown_exit_thread_id =
                     self.active_thread_id.or(self.chat_widget.thread_id());
                 if self.pending_shutdown_exit_thread_id.is_some() {
-                    self.shutdown_current_thread(app_server).await;
+                    // This is a UI escape-hatch budget, not a protocol
+                    // deadline. A healthy local thread/unsubscribe round trip
+                    // should finish comfortably inside two seconds, while a
+                    // longer wait makes Ctrl+C feel broken when the app-server
+                    // is already wedged.
+                    if tokio::time::timeout(
+                        SHUTDOWN_FIRST_EXIT_TIMEOUT,
+                        self.shutdown_current_thread(app_server),
+                    )
+                    .await
+                    .is_err()
+                    {
+                        tracing::warn!("timed out waiting for app-server thread shutdown");
+                    }
                 }
                 self.pending_shutdown_exit_thread_id = None;
                 AppRunControl::Exit(ExitReason::UserRequested)