fix(macos): stop stale injector watcher CPU loops

[jeromychu23]

Summary / 摘要

• Tie every macOS injector watcher to the verified ChatGPT host PID and stop it as soon as that host exits.
• Replace launchctl submit with a one-shot LaunchAgent using KeepAlive=false, while cleaning up legacy submitted jobs and orphaned jobs whose state file is missing.
• Back off failed CDP discovery from 250 ms to a 30-second cap, throttle repeated errors to 30 seconds, and keep SIGINT/SIGTERM interruption immediate.
• Add lifecycle, launch-agent, host-exit, retry, log-throttle, and existing window-readiness regression coverage.

Closes #218

Type / 类型

• Bug fix / 缺陷修复
• Feature / 新功能
• Docs / 文档
• Theme / CSS / visual / 主题或视觉
• Scripts / install / restore / 脚本或安装恢复
• Chore / 杂项

Platform / 平台

• macOS
• Windows
• Both / 双平台
• Docs / repo only / 仅文档或仓库元数据

Self-check / 自测

Docs-only / 仅文档

• Links and wording reviewed / 已检查链接与表述

macOS (when code under macos/ changes)

• macos/tests/run-tests.sh passed / 已通过
• Doctor (optional): macos/scripts/doctor-macos.sh
• Live verify (if inject/CSS/start path): verify-dream-skin-macos.sh or Desktop Verify
• Restore / re-apply smoke (if install/restore/start changed) / 若改了安装恢复啟動則做過恢復再應用

Windows (when code under windows/ changes)

• Relevant install / start / verify / restore scripts exercised / 已按改動跑過對應腳本
• Environment noted below (OS build, Codex source) / 下方註明環境

User-facing / 用户可见变更

• Updated macos/CHANGELOG.md (and macos/VERSION if release-worthy) / 已更新 changelog（發版時再 bump VERSION）
• N/A — no user-facing change / 無使用者可見變更

Security / 安全

• Does not modify official Codex install / asar / signatures / 未修改官方安裝與簽名
• Does not silently write API Base URL or keys / 未靜默寫入 API Base URL 或 Key
• CDP remains loopback-oriented (127.0.0.1) where applicable / CDP 仍僅本機回環（如適用）

Notes / 補充

• Based on the latest upstream main; the unrelated local add Ado theme commit was intentionally excluded.
• The current upstream renderer has already replaced the old root-class mutation path from the local CPU investigation, so this PR preserves that unified renderer and ports only the still-relevant macOS watcher/launchd fixes.
• Passed: CODEX_DREAM_SKIN_SKIP_DOCTOR=1 npm test from macos/, targeted watcher lifecycle and window-readiness tests, shell/Node syntax checks, and git diff --check.
• The suite skipped SwiftPM/XCTest because this Mac does not have a complete matching Xcode macOS platform.
• Doctor was attempted but the current live session failed at its renderer verification step; automated tests were rerun with the repository-supported Doctor skip flag. Live verify and restore/re-apply smoke remain unchecked.
• No files under windows/ changed.

[Fei-Away]

维护者 current-main 复核（main@6f789be / v1.5.12）：#218 的 lifecycle/performance 缺口仍有价值，PR 保持开放。当前 macOS 仍使用 launchctl submit 托管 watcher，host 退出、job bootout、stale state 与重开恢复没有完整绑定；仅因分支冲突不能判定过时。

请基于 current main 重放 host-PID-bound watcher 与一次性 LaunchAgent 的最小改动，保留 signed runtime、exact process identity、Browser ID 和 pause/restore 清理。验收需覆盖 Codex 正常退出、短时 CDP 不可达、重开、重复 start、stale PID/reuse，并在 Apple Silicon 实机记录 bounded retry、日志增长和 CPU。

[Fei-Away]

维护者复核（当前 main@6f789be / v1.5.12）：watcher/launchd 生命周期缺口仍存在，PR 保持开放，但旧 head 需要拆净后重做。

current macOS 仍以 launchctl submit 托管 watcher；CDP 不可达时 discovery 只退避到 500ms，并每 2 秒允许重复错误日志。请基于 current main 收敛为 host-bound one-shot LaunchAgent、可中断的有界退避和日志节流；host 身份应至少绑定 PID、启动时间和可执行路径，不能只依赖 kill(pid, 0)，以防 PID 复用。status-dream-skin-macos.sh 的 lsappinfo 改动请删除，该范围由 #274 的完整可执行路径方案独立处理。

验收需要完整 macOS suite，以及真实退出 Codex 后 watcher/job 消失、30 秒窗口内请求/日志计数有界、SIGTERM 及时退出、pause/restore/reapply 全链路。原描述中的 live/restore 勾选与 Notes 结论不一致，也请用同一 current build 重验后更新。