fix: support Codex 26.727 renderer markers

[ZacharyPatrick]

Summary / 摘要

• Restore theme application on Codex 26.727 after the main shell and header moved to CSS-module class prefixes.
• Keep legacy selectors compatible, preserve the shell-plus-sidebar identity boundary, and recognize the new home route without requiring the removed home-icon.
• Enforce the renderer discovery deadline across target listing, WebSocket open, CDP enable, renderer probing, and retry delay.
• Synchronize the canonical selector contract into macOS and Windows assets and add focused regression coverage.

Verification / 验证

• CODEX_DREAM_SKIN_SKIP_DOCTOR=1 macos/tests/run-tests.sh
• node windows/tests/injector-bootstrap.test.mjs
• node windows/tests/injector-window-readiness.test.mjs
• node tools/sync-runtime-assets.mjs --check
• node --check macos/scripts/injector.mjs
• git diff --check origin/main...HEAD
• Live selector doctor on Codex 26.727.40816: all required L1 selectors passed.
• Local installed smoke: theme-dusk reached session=active, with injector and loopback CDP healthy.

SwiftPM/XCTest was skipped because this Mac has Command Line Tools but no matching full Xcode platform.

Security / 安全

• CDP remains bound to local loopback only.
• Renderer identity still requires the guarded shell and sidebar combination.
• No modification to the official ChatGPT/Codex app, app.asar, code signature, API key, or Base URL.
• TASK_PROGRESS.md is intentionally excluded from this PR.