[codex] restore appearance after failed Windows startup

[Fei-Away]

What changed

• Persist a strict, bounded 64 KiB Windows startup-appearance journal before marker/config commits and promote it from preparing to committed only after the operation is complete.
• Recover managed appearance keys and the ownership marker with a three-way Before / Applied / Current comparison. Already-restored values are accepted, newer user edits win, and malformed or internally inconsistent journals fail closed with evidence retained.
• Give the one-click child its lock timeout plus a separate 300-second startup/recovery grace. The parent never force-kills a still-running child and does not delete a result that the child may still be writing.
• Keep active-theme files coherent for timeout, invalid, blocked, retained, and preserved-rendered outcomes. A result-token child with visible-but-inconclusive rendering closes only its exact matching CDP session, restores appearance, and reopens ordinary Codex before the parent rolls files back.
• Preserve bounded failure categories end to end so access denial, missing CDP endpoints, reconciliation failures, and recovery state remain diagnosable without paths, PIDs, logs, or raw exceptions.

Root cause

Windows startup writes Codex appearance keys before the official app has exposed a verified CDP endpoint and rendered the selected background. A caught failure could therefore leave colors applied with no background renderer. The previous marker/config ordering also had a hard-stop window, while one-click apply could force-kill a slow child using the lock timeout as its entire runtime budget or roll files back after the child intentionally retained a rendered session.

The new durable journal precedes both appearance writes, and recovery restores only values still owned by that exact attempt. It does not replace the whole historical config.toml.

User impact

Caught and interrupted Windows starts no longer leave deterministic partial appearance state. Newer config and marker edits are preserved. If Dream Skin cannot prove that Codex was closed or recovery completed safely, it preserves the candidate theme and exact prior snapshot instead of creating a mixed file/session state.

This does not restore an upstream-disabled CDP endpoint. Official Store Codex 26.803.5235.0 still has field evidence in #235 of Verify rejection and a final NO_LISTENER. This PR fixes the deterministic residue and diagnostics around that failure; it does not claim every report in #352/#354 is resolved without the reporter's exact Codex version and Verify output.

Validation

• Final independent read-only audit: no remaining P0/P1
• PowerShell 7.6.4: seven focused config/start/result/community suites pass together
• Portable Node: 103/103 (macOS 74, Windows 27, tools 2)
• PowerShell AST and PS5.1 encoding policy: 23/23 files pass
• All Node/Bash syntax checks: pass
• macOS and Windows payload checks: pass
• Runtime asset sync: pass
• CODEX_DREAM_SKIN_SKIP_DOCTOR=1 bash macos/tests/run-tests.sh: exit 0, including signed-runtime and runtime-state integration
• git diff --check: pass

Full-Xcode SwiftPM/XCTest and installed signed-app Doctor are explicit local host skips. Native Windows PowerShell 5.1/7 and Setup.exe are required from CI on exact head 6103a9a09ee274a2d820ef26738f8acee05b7026; the older green run does not validate this head.

Related to #235, #352, and #354.