feat: restore Linux Browser Use and upstream compatibility

[cau1k]

Summary

• ship a static Linux x86-64 Chrome native-messaging host with protocol-v2 app-server proxying, legacy Browser Use relay, registry selection, origin checks, bounded queues, and packaged notices
• reject managed registry entries whose native-host name, extension ID, or build channel is incompatible before ranking
• wire the official ChatGPT Chrome extension into Linux packaging while preserving the trusted browser client and accepting both patched and current native upstream Chrome discovery
• align the bundled Linux Codex + code-mode host with the current ChatGPT desktop archive (0.146.0-alpha.3.1, SHA-256 pinned)
• preserve current upstream Electron/RPC discovery and expose the missing web-shell Sparkle query-params method
• strengthen package smoke diagnostics, process cleanup, CI/Nix Rust tooling, and regression coverage
• document the ChatGPT archive migration while retaining stable downstream npm/AUR/command identities

Root causes

• Managed registry: host name, extension ID, and build channel were ranking bonuses, allowing a zero-match entry to launch under the caller's identity. They are now eligibility filters.
• Browser Use: upstream macOS archives exposed Linux install paths without a Linux native host. Linux Chrome therefore could not bridge the extension to the desktop app.
• Builds Upstream canary failed: prod build 26.707.41301 #43-Upstream canary failed: prod build 26.707.72221 #48: upstream removed the forced .vite/build/bootstrap.js entrypoint. Current main already preserves the upstream entrypoint; this adds the missing regression guard.
• Web shell Upstream canary failed: prod web-browser-shell 26.707.72221 #49: upstream bundle initialization can replace Function.prototype.toString, breaking semantic RPC export discovery.
• Web shell Upstream canary failed: prod web-browser-shell 26.715.21316 #50-Upstream canary failed: prod web-browser-shell 26.721.41059 #65: upstream calls appUpdates?.setSparkleQueryParams(). The Linux host exposed appUpdates but omitted that method, so optional chaining did not protect the call.
• Migration Migrate to ChatGPT.dmg app (?) #42: upstream artifacts are now ChatGPT archives. Distribution identity does not need to change; the existing Linux package names remain the compatibility boundary.

Related PR review

• feat: enable Chrome extension Browser Use on Linux #36: substantive Browser Use implementation. Rebased selectively onto current main, retained the audited host/protocol work, and added current upstream detection/runtime coverage. Stale dynamic-tool normalization was excluded because the current bundled app-server accepts canonical and legacy formats natively.
• fix: keep upstream entrypoint and update Linux runtime #41: not mergeable as-is. Entrypoint/macOS-payload fixes already landed on main; its 0.144.1 runtime pin is stale. This PR keeps the useful entrypoint regression and pins the exact current ChatGPT runtime instead.
• fix(webstrap): stub Sparkle query params in web shell #53: exact Sparkle RPC compatibility fix integrated with its regression test.

Validation

• npm test — 120 Node tests + 58 Rust tests
• cargo fmt --manifest-path native/chrome-extension-host/Cargo.toml -- --check
• cargo clippy --locked --manifest-path native/chrome-extension-host/Cargo.toml --all-targets -- -D warnings
• prod canary: ChatGPT 26.721.41059 build 5848, package 26.721.41059-launcher.35, 12/12 artifact/desktop/browser checks
• beta canary: ChatGPT Beta 26.715.31251 build 5539, package 26.715.31251-beta.5539.launcher.35, 12/12 checks
• both canaries remained publish-blocked before mutation
• packaged codex --version: codex-cli 0.146.0-alpha.3.1
• packaged code-mode and Chrome extension hosts: x86-64 static PIE

Scope

Linux x86-64 + stable Google Chrome. Browser Use only; Computer Use remains out of scope.

Closes #14
Closes #33
Closes #42
Closes #43
Closes #44
Closes #45
Closes #46
Closes #47
Closes #48
Closes #49
Closes #50
Closes #51
Closes #52
Closes #54
Closes #55
Closes #56
Closes #57
Closes #58
Closes #59
Closes #60
Closes #61
Closes #62
Closes #63
Closes #64
Closes #65