Prove the Codex sidebar and standalone Host Adapters

[codeacme17]

Tracks #1.

Summary

Prove the unsupported Codex sidebar integration behind a replaceable Host Adapter while keeping the same placeholder surface available through a standalone adapter.

Scope

• Implement the HostAdapter.attach() / HostConnection contract.
• Add a CodexCdpHostAdapter that discovers a compatible Codex renderer, adds one Git sidebar entry, and mounts an opaque sandboxed iframe in the main content surface.
• Restore the native Codex surface when another sidebar destination is selected.
• Reattach after compatible renderer/DOM replacement without duplicating sidebar entries or frames.
• Forward Current Project, theme, and current task context as typed host-context messages.
• Add capability/challenge validation for iframe-to-host actions.
• Implement the StandaloneHostAdapter against the same contract.
• Add compatibility probes, complete teardown, and a fail-closed fallback to the standalone surface.

Acceptance criteria

• The placeholder surface can be opened from a top-level Git entry in a supported Codex Desktop build.
• Switching between Git and native Codex destinations leaves no hidden or obstructing native content.
• Repeated attachment and renderer rerenders produce exactly one sidebar entry and one active surface.
• The iframe does not receive allow-same-origin, popup, or top-navigation authority.
• Stale frame generations and messages without the current capability/challenge are rejected.
• A failed compatibility probe does not mutate the Codex UI and reports a standalone fallback.
• Removing the Codex adapter leaves the standalone product path operational.
• Installation/runtime diagnostics disclose that local CDP is an unsupported, trusted-local-process boundary.

Out of scope

• Git state, Git commands, final visual design, Tauri packaging, or modifying Codex application files/private JavaScript state.

Dependencies

• Bootstrap the TypeScript workspace and standalone runtime #3.

Verification

• Host Adapter contract tests for both adapters.
• DOM fixture tests for mount, navigation, remount, idempotency, and cleanup.
• Manual smoke matrix against explicitly recorded Codex Desktop versions.

[codeacme17]

Delivery is split into two independently reviewable changes:

1. The first PR will land the Host Adapter contract, standalone behavior, Codex DOM lifecycle/security primitives, and CSP lease foundation. It will reference this issue without closing it.
2. Connect and smoke-test the dedicated Codex CDP renderer #30 tracks production CDP renderer discovery/transport, dedicated-instance ownership binding, launcher composition, replacement/fallback behavior, and the exact-version manual smoke matrix.

Issue #4 remains open until both parts are complete.