[codex] harden manager update flows

[Wangnov]

Summary

• Guard Windows perform installs with a confirmed plan snapshot and re-check stale confirmations before destructive work.
• Harden Windows install/uninstall lifecycle diagnostics: MSIX dependency version/publisher/arch checks, probe-failure fallback, portable cleanup warnings, and residual MSIX notes.
• Replace Windows URL opening via shell with validated system API launch, tighten CSP, normalize unsupported Windows official source settings, and harden release/mirror sync gates.
• Make macOS managed install detection path-aware so a system install cannot mask the app-managed target.

Validation

• npm run check
• npm run test --if-present
• npm run build
• cargo test --manifest-path src-tauri/Cargo.toml --workspace
• cargo clippy --manifest-path src-tauri/Cargo.toml --workspace --all-targets -- -D warnings
• cargo test --manifest-path src-tauri/Cargo.toml --workspace --no-run
• cargo test --manifest-path crates/codex-win-engine/Cargo.toml
• cargo test --manifest-path crates/codex-mac-engine/Cargo.toml
• npm audit --audit-level=moderate
• bash -n scripts/sync-mirror.sh
• ruby -e 'require "yaml"; YAML.load_file(".github/workflows/release.yml"); puts "release yaml ok"'
• git diff --check