feat(desktop): codex app-server transport, correcting L4a's dead daemon rung (L4b)

[physercoe]

What

The transport a local codex session uses to reach an app-server — and a
correction to the rung #568 (L4a) shipped two commits ago.

The bug this fixes

L4a shipped codex app-server proxy --sock <path> as the daemon data path,
on the strength of that subcommand's help text: "Proxy stdio bytes to the
running app-server control socket". It cannot carry the protocol, and it
fails in the worst possible way — exit 0, no stdout, no stderr. A dead
channel that reads exactly like a quiet agent.

Measured with a logging relay placed between the CLI and its own socket:

	what it puts on the wire
daemon version (the vendor's own client)	GET / HTTP/1.1 + Upgrade: websocket → 101 Switching Protocols, then JSON-RPC inside frames
app-server proxy --sock	our stdin verbatim, no upgrade

The daemon closes on the first byte of anything that is not an HTTP upgrade —
valid JSON-RPC and pure garbage close identically, so it is not a parse error.

So the control socket is a WebSocket server bound to a Unix domain socket
(the daemon's own argv is app-server --listen unix://). The plan's original
"WebSocket attach" was right and L4a's correction of it was wrong; what the
plan actually got wrong was the auth — there is no bearer scheme, the socket is
srw------- and filesystem permissions are the auth.

Both causes L4a guessed at are now disproven: not a framing question
(Content-Length and half-close fail identically), and not
enable-remote-control — the live round trip succeeds with remote control
reporting disabled throughout, so that security-posture toggle was never
needed and stays off.

As built

• CodexAttachPlan is now a discriminated union. A daemon plan carries a
  socketPath and cannot carry an argv — the shipped bug is unrepresentable,
  not merely fixed.
• codexchannel.ts opens either rung behind one send/onFrame surface.
  The spawn rung reassembles newline-delimited JSON across chunk boundaries; the
  WebSocket rung must not buffer, since a message with no trailing newline is
  already complete and holding it would stall the channel forever.
• perMessageDeflate: false is load-bearing. ws offers permessage-deflate
  by default and the daemon hangs up on the handshake rather than declining
  the extension. Isolated by varying one option at a time against the live
  daemon.
• A daemon that will not come up falls back to spawn, and says so. "Shared
  with your codex TUI" and "dies with this window" are different promises; a
  silent downgrade leaves the user holding the wrong one. And close() on a
  daemon channel closes our socket only — the rung exists so the session
  outlives us.
• codexBinary searches the well-known install dirs, because the official
  installer writes ~/.local/bin/codex with its PATH line in .bashrc — which
  a GUI-launched Electron app never sources.

Verification

• 26 unit tests; 13 mutations, all killed.
• An opt-in live e2e (TERMIPOD_CODEX_ATTACH_E2E=1) round-trips
  initialize against a real daemon and asserts the daemon survives a client
  disconnect. It restores the daemon's prior state afterwards.
• The deflate mutation is killed only by the e2e, and it fails with the real
  symptom (socket hang up). No unit test can see that handshake — which is the
  whole reason L4a's error survived review.
• Full electron suite 658 tests / 0 fail, typecheck clean, CI lint set + desktop
  token ratchet + openapi all pass.

Scope

Not yet reachable from main.ts, like L4a — this is the transport. L4c is
the driver that wires it in, so no user-visible behaviour changes yet. The
translation half already exists: the hub's codex frame profile ships to the
desktop in agent_families.generated.json, so L4c reads that table rather than
writing a second one.