fix(macos): harden runtime identity and add cross-platform CI

[Fei-Away]

Summary / 摘要

• Enforce exact macOS CDP listener ownership through the real executable path and Codex process ancestry; remove HTTP and command-substring fallbacks.
• Validate the bundled Node against the Apple trust chain, fixed OpenAI Team ID, architecture, and minimum version on hot paths; remove arbitrary NODE and Team ID overrides.
• Require PID, start time, canonical Node/injector paths, port, and full command shape before stopping an injector, with a second PID-reuse check before SIGKILL.
• Ignore malformed CDP frames and capture screenshots without dispatching keyboard or mouse input.
• Read the macOS release version from VERSION and add read-only cross-platform CI for Bash, Node, PowerShell syntax, payloads, version consistency, loopback, and no-asar-mutation rules.

Security / 安全

• No README changes.
• No dependency, credential, API base URL, network download, official app, app.asar, WindowsApps, or signature mutation.
• GitHub Actions uses contents: read only, disables persisted checkout credentials, and pins actions/checkout to commit 11bd71901bbe5b1630ceea73d27597364c9af683.
• Full app validation checks the bundle seal and separately verifies the Node executable. Hot runtime validation measured about 1-5 seconds depending on filesystem cache, versus about 39 seconds for the previous recursive bundle scan.

Validation / 验证

• .github/scripts/ci-static-checks.sh
• NODE=/Applications/Codex.app/Contents/Resources/cua_node/bin/node ./macos/tests/run-tests.sh
• git diff --check
• YAML parsed successfully with Ruby standard YAML parser
• Positive and negative PID identity fixtures passed; no temporary process or directory remained

Fixes #11
Fixes #12
Fixes #13
Fixes #16
Fixes #19
Fixes #20

[Fei-Away]

Superseded by the focused fixes now merged to main in 086f64f and f7bf17e. Closing this stale, conflicted PR instead of merging its obsolete CI, version, and watcher changes.

[bestlynnn]

你好，我想向你咨询关于这个项目的合作/问题，请问方便留一个联系方式吗？