fix(macos): allow no-write installs with multiline TOML

[rwang23]

Summary / 摘要

中文

• 修复 macOS 安装在 config.toml 任意位置出现多行字符串、多行数组或重复表头时无条件退出的问题。
• 当前版本的两个外观设置值都是 null，安装不会写入配置。脚本现在先完成严格 UTF-8、NUL 和普通文件校验；确认没有计划写入后，直接保留原文件，也不创建无用备份。
• 没有备份时，恢复操作安全返回。如果已有旧版备份，仍使用原来的多行 TOML、重复表头、备份身份、并发与原子写入检查。
• 扩展现有回归测试，覆盖中文配置、多行 MCP args、多行字符串、重复 [desktop]、现有备份保留、旧备份恢复、无效 UTF-8、NUL 和符号链接。

English

• Fixes macOS installation failing whenever config.toml contains a multiline string, multiline array, or duplicate table header.
• Both managed appearance values are currently null, so install has no configuration write to perform. The script now completes strict UTF-8, NUL, and regular-file validation, then returns before structural TOML parsing and backup creation when no write is planned.
• Restore is a safe no-op when no backup exists. Existing backups still use the original multiline TOML, duplicate-table, backup identity, concurrency, and atomic-write checks.
• Extends the current regression block for Chinese config text, multiline MCP args, multiline strings, duplicate [desktop] tables, backup preservation, legacy restore, invalid UTF-8, NUL, and symbolic links.

Closes #67

Type / 类型

• Bug fix / 缺陷修复
• Feature / 新功能
• Docs / 文档
• Theme / CSS / visual / 主题或视觉
• Scripts / install / restore / 脚本或安装恢复
• Chore / 杂项

Platform / 平台

• macOS
• Windows
• Both / 双平台
• Docs / repo only / 仅文档或仓库元数据

Self-check / 自测

Docs-only / 仅文档

• Links and wording reviewed / 已检查链接与表述

macOS (when code under macos/ changes)

• macos/tests/run-tests.sh passed / 已通过
• Doctor (optional): macos/scripts/doctor-macos.sh
• Live verify (if inject/CSS/start path): verify-dream-skin-macos.sh or Desktop Verify
• Restore / re-apply smoke (if install/restore/start changed) / 若改了安装恢复启动则做过恢复再应用

Windows (when code under windows/ changes)

• Relevant install / start / verify / restore scripts exercised / 已按改动跑过对应脚本
• Environment noted below (OS build, Codex source) / 下方注明环境

User-facing / 用户可见变更

• Updated macos/CHANGELOG.md (and macos/VERSION if release-worthy) / 已更新 changelog（发版时再 bump VERSION）
• N/A — no user-facing change / 无用户可见变更

Security / 安全

• Does not modify official Codex install / asar / signatures / 未修改官方安装与签名
• Does not silently write API Base URL or keys / 未静默写入 API Base URL 或 Key
• CDP remains loopback-oriented (127.0.0.1) where applicable / CDP 仍仅本机回环（如适用）

Notes / 补充

中文

• node --check macos/scripts/theme-config.mjs：通过。
• git diff --check：通过。
• 直接运行 macos/tests/run-tests.sh 中的配置回归区段：通过。覆盖无写入安装、无备份恢复、旧备份恢复、备份保留、多行 TOML、中文、无效 UTF-8、NUL 与符号链接。
• 在 node:24-bookworm-slim 中运行完整入口时，Shell 语法、图像元数据、注入启动、渲染器和主题暂存测试通过。随后镜像里的 GNU stat 不支持 macOS 的 /usr/bin/stat -f '%z'，因此没有勾选完整套件。
• 独立安全审查未发现阻止提交的正确性、数据丢失或兼容性问题；审查提出的无备份恢复校验用例已经补充并通过。

English

• node --check macos/scripts/theme-config.mjs: passed.
• git diff --check: passed.
• The configuration regression section from macos/tests/run-tests.sh passed. It covers no-write install, restore without a backup, legacy restore, backup preservation, multiline TOML, Chinese text, invalid UTF-8, NUL, and symbolic links.
• The full entry point passed shell syntax, image metadata, injector bootstrap, renderer, and theme staging checks in node:24-bookworm-slim. The image then reached a GNU stat incompatibility with macOS /usr/bin/stat -f '%z', so the full-suite checkbox remains unchecked.
• An independent safety review found no blocking correctness, data-loss, or compatibility issue. Its requested restore-without-backup validation cases were added and passed.

[Fei-Away]

Closing this old patch without merging it. The underlying compatibility report remains tracked in #67, but current main no longer has the no-write premise used here: fixed-appearance themes now deliberately pin appearanceTheme, with newer backup identity, locking, concurrency, and atomic-write guarantees. Rebasing this early return would bypass that current behavior rather than solve multiline TOML safely. A future #67 fix should be rebuilt against the current parser and preserve the fixed-theme pin/restore contract.