Codex

## Summary

Add a Windows x64 Rust `codex-bridge.exe` owned by adom/codex, using the AB SDK
compiled-executable lifecycle contract. No AB core changes, Node runtime or Python
runtime. Forty verbs cover official desktop install/removal, preserved auth-cache
reuse, native app-server RPC, plugins, events/approvals and actual desktop tools.

Desktop-native tools use a PID-verified Windows named pipe with explicit endpoint
selection when ambiguous. The separate bridge-owned app-server is clearly labeled
and never presented as attachment to Windows desktop-owned active sessions.

## Verification

- `cargo test --locked`: 13 unit/mock tests and one HTTP integration test pass.
- `cargo clippy --all-targets -- -D warnings`: Linux and Windows cross-target pass.
- Windows release ZIP builds; root contains only executable and bridge.json.
- Live arav-rog: AB 2.1.72, OpenAI.Codex 26.901.6511.0, native CLI 0.153.4.
- Official Store install with explicit user agreement acceptance; package identity verified.
- Authorized cached-auth transfer, owner-only destination ACL, staging deleted;
  native account identity verified. No credential values in bridge replies/logs.
- Separate backend returned CODEX_BRIDGE_OK; actual desktop-created thread returned
  DESKTOP_BRIDGE_OK via native read_thread. Persisted reply survived reinstall.
- LaTeX plugin installed and read back enabled, then removed and read back absent.
- Desktop uninstall refused a running app; removal succeeded after closing the
  task-owned idle test process. Reinstall preserved account and native history.
- Final AB registration has one compiled-binary instance, no entry mismatch,
  stable port 63514, and a development pin. No install on AdomLapper.
- Deployed executable SHA256:
  `233294b692fc7bfc7ac262afcfb0f0268af5f60455f1f1a48f9b8776f468401c` (0.1.1).
- ZIP SHA256:
  `b961fa8539ced307da6a5b225d198c1029ab11de55c1c3409389db9a3de73985` (0.1.1).

## Remaining work

The role-confirmation screen advanced after explicitly selecting the existing
Engineering role. Optional demo tasks and cross-app imports were skipped. The user
approved Finish Windows setup's UAC prompt. The signed-in main app and saved
DESKTOP_BRIDGE_OK reply were visually verified afterward; first-run setup is complete.
Bridge 0.1.1 adds `_setupHint` and a ready-to-send `_beforeUac` AB toast payload to
describe/status/readiness/install/open responses. Setup skills require the warning
BEFORE elevation, with selected-target/caller identity, app focus, and a chat
notice in case Windows suppresses the banner. Toast clicks are never UAC consent.
No UAC prompt is re-triggered or falsely announced on an already-configured host.
Keep the PR draft for review; no merge or public release is implied.
Native desktop pipe compatibility is experimental and
must be rechecked when OpenAI changes the desktop build. Worktree/automation
schemas were discovered, not destructive or recurring actions exercised.

Runtime is dev-pinned on arav-rog. The ZIP is a local candidate, not publicly
released. Publish the reviewed ZIP/update manifest and package together later;
do not merge or promote automatically. The existing wiki package linter has no
errors; unrelated baseline warnings remain. Main advanced during this work; use
the branch PR's three-way merge and preserve concurrent reload integration work.