fix(issue-23-24): merge review - the environment form of the auto-trust switch reaches the handler; a rate-limited dialog does not hide the next one

Two probes from the merge-side codex review (its report was lost to an API
outage; the probes and their results were recovered from its transcript):

- create_session.sh and resume_session.sh set AUTO_TRUST=1 and then
  exported MAM_AUTO_TRUST from it, so the documented MAM_AUTO_TRUST=0
  without a flag reached handle_startup_dialogs as 1: the operator had
  turned automatic trust off and it stayed on. Now AUTO_TRUST defaults to
  the environment value and an explicit --auto-trust/--no-auto-trust wins.
- _mam_dialog_pick exited on the first dialog inside its resend cooldown
  instead of looking further down the screen, so a skipped (--no-auto-trust)
  or just-answered trust prompt hid the codex update notice below it, which
  the docs say is always answered. It continues to the next dialog now; S5
  and S5b (one send per cooldown, one retry after it) still hold.

Regressions: S6c, S5f (startup path), R3b and C3 (resume/create, env only,
flag over env). Each fails without the fix. The create skill doc names the
environment form and its precedence.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VCgu9Fa9iT7TbJUSzdq4Ff

.agents/skills/multi-agent-mux-create/SKILL.md

@@ -116,7 +116,8 @@ The bootstrapped server receives a **sanitized copy of the caller's environment*
    blocking-modal signatures and their accept keys live in each agent adapter
    (`lib_py/agents/adapters/*.py`, published as `MAM_STARTUP_DIALOGS`), and they
    are answered while waiting for the TUI rather than after it. `--no-auto-trust`
-   leaves directory-trust dialogs for a human to accept and still answers other
+   (or `MAM_AUTO_TRUST=0` in the environment; an explicit flag wins over the
+   environment) leaves directory-trust dialogs for a human to accept and still answers other
    blocking notices (for example codex's update prompt, where Skip changes
    nothing). Trust matters most for **codex**: trusting a directory makes it load
    that project's local config, hooks and exec policy, so `--no-auto-trust` is the