fix(theme): preserve native side-panel controls

[eistinlandfrank]

Summary / 摘要

• Preserve Codex's native header position and z-index so the task side-panel toggle stays inside the viewport and clickable.
• On macOS, exclude the native header from the broad task-route child layering rule that otherwise restores position: relative.
• Add regression assertions to the existing renderer tests, plus Windows/macOS changelog and QA coverage.
• Keep the current main-surface overflow behavior unchanged to avoid unrelated content-bleed regressions.

Root cause: the theme's more-specific header rule replaced Codex's native fixed z-30 geometry with position: relative and a lower stacking level. Opening the right task panel then narrowed the main surface and could push or clip the native toggle outside the viewport.

Related: #64 was opened while this fix was in progress. This draft is a cross-platform, narrower alternative: it also preserves the native z-index, leaves main.main-surface overflow unchanged, and covers the equivalent macOS selector.

Type / 类型

• Bug fix / 缺陷修复
• Feature / 新功能
• Docs / 文档
• Theme / CSS / visual / 主题或视觉
• Scripts / install / restore / 脚本或安装恢复
• Chore / 杂项

Platform / 平台

• macOS
• Windows
• Both / 双平台
• Docs / repo only / 仅文档或仓库元数据

Self-check / 自测

Docs-only / 仅文档

• Links and wording reviewed / 已检查链接与表述

macOS (when code under macos/ changes)

• macos/tests/run-tests.sh passed / 已通过
• Doctor (optional): macos/scripts/doctor-macos.sh
• Live verify (if inject/CSS/start path): verify-dream-skin-macos.sh or Desktop Verify
• Restore / re-apply smoke (if install/restore/start changed) / 若改了安装恢复启动则做过恢复再应用

Windows (when code under windows/ changes)

• Relevant install / start / verify / restore scripts exercised / 已按改动跑过对应脚本
• Environment noted below (OS build, Codex source) / 下方注明环境

User-facing / 用户可见变更

• Updated macos/CHANGELOG.md (and macos/VERSION if release-worthy) / 已更新 changelog（发版时再 bump VERSION）
• N/A — no user-facing change / 无用户可见变更

Security / 安全

• Does not modify official Codex install / asar / signatures / 未修改官方安装与签名
• Does not silently write API Base URL or keys / 未静默写入 API Base URL 或 Key
• CDP remains loopback-oriented (127.0.0.1) where applicable / CDP 仍仅本机回环（如适用）

Notes / 补充

• Windows live check: Windows 11 build 26200, Store Codex 26.707.9981. Before the fix, a 1294px viewport placed the toggle at x=1568; after preserving native header geometry it was at x=1258. The task side panel opened and closed twice successfully while the existing overflow: hidden rule remained unchanged.
• Passed with Node 24.14.0: all four Windows *.test.mjs files, Windows injector --self-test and --check-payload, and the macOS image-metadata, injector-bootstrap, and renderer-inject tests.
• Passed node --check for both renderer payloads.
• macos/tests/run-tests.sh and macOS live verify require a macOS runner and were not run on this Windows host.
• The full Windows PowerShell suite could not complete cleanly on this host: Windows PowerShell 5.1 misread the UTF-8/no-BOM test file via -File; a forced-UTF-8 harness progressed to the existing native-stderr capture assertion. The focused renderer and injector tests above passed.
• No screenshot is attached because the live task contained private content; the QA inventory now records a repeatable side-panel check.

[Fei-Away]

Maintainer update: rebased the original contributor commit onto current main after #52 and #58, preserving @eistinlandfrank as author. The narrower fix leaves main-surface overflow unchanged, removes only the theme overrides that replaced Codex’s native fixed header geometry, and retains the cross-platform regression/QA coverage.

Local macOS and Windows Node regressions (8/8), both payload checks, shell syntax, and git diff --check pass. Waiting for the full Windows PowerShell 5.1/7 CI before final review.

[Fei-Away]

The root cause and scope are sound: preserve Codex’s native fixed header geometry, exclude that header from the macOS task-child positioning rule, and leave main-surface overflow unchanged. The contributor supplied a real Windows reproduction (toggle x=1568 before, x=1258 after) and repeated open/close validation. Current static checks and both Windows PowerShell suites are green.

[Fei-Away]

Final validation on current main: Static checks ✅, Windows PowerShell 5.1 ✅, PowerShell 7 ✅. Merging the narrower cross-platform fix; it preserves the native header without relaxing main-surface overflow.