`--output-last-message` doesn't create parent dirs; write fails after the turn completes yet exits 0, silently losing the final message

What happened

codex exec --output-last-message <path> does not create the parent directory of <path>. If the directory doesn't exist, the failure surfaces only after the turn completes — the model does all its work, the JSONL stream ends with turn.completed, and then the final-message write fails with a line on stderr:

Failed to write last message file "/tmp/.../missing-dir/out.md": No such file or directory (os error 2)

Worse, the process still exits 0, so the failure is invisible to any script checking the exit code. The tokens are spent, the final message is lost, and nothing but a stderr line (easily swallowed in headless/background contexts) indicates anything went wrong.

Repro

codex exec -s read-only --skip-git-repo-check --json \
  --output-last-message /tmp/does-not-exist-$RANDOM/out.md \
  "Output exactly: REPRO" </dev/null
echo $?   # prints 0; no file was written

Observed on codex-cli 0.144.5, macOS 26 (Darwin 25.5.0, arm64).

Expected

Any of these would fix it (in descending order of preference):

1. Create parent directories before writing, like most output-file flags.
2. Validate the path at argument-parse time and fail fast — before the run spends tokens.
3. At minimum, exit non-zero when the write fails so orchestration scripts can detect the loss.

Why it matters

--output-last-message is the natural primitive for headless orchestration (one output file per background worker). In that setting the flag's current behavior is the worst possible combination: the cost is incurred, the artifact is lost, and the exit code reports success. We now mkdir -p defensively before every dispatch, but the failure mode is subtle enough that it seems worth fixing at the source.