fix: support Codex 26.727 renderer markers

[ZacharyPatrick]

Summary / 摘要

• Restore theme application on Codex 26.727 after the main shell and header moved to CSS-module class prefixes.
• Keep legacy selectors compatible, preserve the shell-plus-sidebar identity boundary, and recognize the new home route without requiring the removed home-icon.
• Enforce the renderer discovery deadline across target listing, WebSocket open, CDP enable, renderer probing, and retry delay.
• Synchronize the canonical selector contract into macOS and Windows assets and add focused regression coverage.

Verification / 验证

• CODEX_DREAM_SKIN_SKIP_DOCTOR=1 macos/tests/run-tests.sh
• node windows/tests/injector-bootstrap.test.mjs
• node windows/tests/injector-window-readiness.test.mjs
• node tools/sync-runtime-assets.mjs --check
• node --check macos/scripts/injector.mjs
• git diff --check origin/main...HEAD
• Live selector doctor on Codex 26.727.40816: all required L1 selectors passed.
• Local installed smoke: theme-dusk reached session=active, with injector and loopback CDP healthy.

SwiftPM/XCTest was skipped because this Mac has Command Line Tools but no matching full Xcode platform.

Security / 安全

• CDP remains bound to local loopback only.
• Renderer identity still requires the guarded shell and sidebar combination.
• No modification to the official ChatGPT/Codex app, app.asar, code signature, API key, or Base URL.
• TASK_PROGRESS.md is intentionally excluded from this PR.

[Fei-Away]

维护者复核（基于当前 main@6f789be / v1.5.12）：这个分支需要关闭重提，但其中的全局 CDP deadline 仍有价值。

本 PR 的 Codex 26.727 shell/header/Settings selector 与 readiness 部分已经被后续的 #324（merge commit a58e63c）和 #334（merge commit 6e71534）以共享 selector/runtime、双端同步和更完整回归独立交付。继续保留这里的旧 selector 快照会与现行 generic identity、Settings L0、message bridge 和生成资产合同冲突。

但 current main 的 connectCodexTargets 仍只在外层检查 deadline：单个 WebSocket open 最长 5 秒，后续 Runtime.enable / Page.enable / probe 各自还有独立预算，因此一个很小的 --timeout-ms 仍可能被嵌套操作明显突破。你新增的“80ms 全链路预算”回归抓到的是当前真实缺口，不应丢失。

因此关闭这个已混合且冲突的旧 PR，不删除分支。请从 current main 重提一个 deadline-only PR：只改 macOS CDP discovery/session 的剩余预算传播和对应测试；同时确保 open/handshake 失败关闭新建 socket，并保留现行 app://、loopback、target identity 与生成资产边界。不要再携带 selector/CSS/Windows generated-asset 改动。