Connect the dedicated Codex CDP renderer

[codeacme17]

Summary

• launch and ownership-bind a disposable Codex Desktop profile through its loopback CDP endpoint
• validate the exact Codex build and Chromium version before applying a target-scoped CSP bypass
• mount the Git surface through public DOM anchors, preserve trusted project binding across renderer generations, and publish typed standalone fallback transitions
• compose the hosted adapter in the launcher with reliable cleanup and standalone fallback

Scope

This PR completes the production Codex-hosted path tracked by #30. Git behavior, normal user-owned Codex windows, private JavaScript state, packaging, and distribution remain out of scope.

Known pre-existing defects in the touched area: none identified.

Verification

• npm test — 12 test files, 28 tests passed
• npm run lint
• npm run build
• npm run format:check
• exact-version disposable-profile smoke: Codex Desktop 26.820.60940 build 7119, Chromium 151.0.7922.170; initial attach, sandboxed surface, native restore, renderer reload/remount, and complete teardown passed

Closes #30