feat: add Host Adapter contract and Codex DOM foundation

[codeacme17]

Part of #4.

Summary

• define a typed Host Adapter contract for attachment, context updates, native actions, fallback diagnostics, and teardown
• implement the standalone adapter against that contract
• add a strict Codex Desktop compatibility profile and transactional DOM attachment lifecycle
• isolate the loopback Git surface in an opaque sandbox and authenticate host messages with per-frame capability, challenge, source, and generation checks
• add a retryable, renderer-scoped Page.setBypassCSP lease primitive for explicitly dedicated Codex Git renderers
• document the tested Codex/Chromium profile, trust boundary, and pending smoke matrix

Scope

This PR establishes the Host Adapter and DOM/security foundation. It intentionally does not close #4.

Verification

• npm test — 8 files, 16 tests passed
• npm run typecheck
• npm run lint
• npm run format:check
• npm run build

Out of scope

• Production CDP discovery and transport, dedicated-instance ownership binding, launcher composition, same-renderer DOM replacement, renderer replacement, explicit fallback transitions after attachment, and the manual smoke run are tracked in Connect and smoke-test the dedicated Codex CDP renderer #30.
• Git state and Git command behavior remain tracked by later roadmap issues.

Review note

pr-preflight was offered for c8025fb...a16ebd8 and explicitly skipped before push.