Add Codex Desktop Guard web UI and harden Windows update repair workflows

[dilong888]

Summary

• add a read-only Codex Desktop Guard web UI with a lightweight local Python server, start/stop helpers, richer guard status data, and quick access to logs and staging output
• add raw-package acquisition and discovery hardening for Guard, including optional community mirror fallback, clearer waiting states, and more resilient patched-update/native build orchestration
• harden Windows Desktop repair flows for newer Codex builds, including Fast Mode and browser-use target detection updates, %40oai Computer Use runtime compatibility, and safer AppsFolder relaunch after MSIX install
• update the repo docs and skill guidance to cover the new Guard/update-repair workflow and current Windows repair expectations

Background

• the original direction for Codex Desktop Guard itself, the raw-package mirror fallback workflow, and the Guard web panel came out of user-driven real-machine experimentation on a Windows install that repeatedly hit update and repatch edge cases
• this PR takes that field-tested workflow, removes machine-specific assumptions, and packages it into a more reusable upstream path

Validation

• git diff --check
• PowerShell parse check for scripts/*.ps1
• node --check scripts/patch-remote-control-asar.cjs
• python -m py_compile scripts/codex_desktop_guard_ui_server.py
• powershell -NoProfile -ExecutionPolicy Bypass -File .\scripts\install-computer-use-local.ps1 -StrictVerifyOnly
• powershell -NoProfile -ExecutionPolicy Bypass -File .\scripts\patch_codex_fast_mode_windows_msix.ps1 -DryRun -ForceRebuild
• powershell -NoProfile -ExecutionPolicy Bypass -File .\scripts\repatch-codex-windows.ps1 -DryRun -SkipFastVerify
• GET http://127.0.0.1:8765/api/status returned 200 against the running local Guard UI

Notes

• this branch keeps repair operations in external executors and does not add machine-local auth, token, browser profile, or other sensitive user state
• the Windows validation above was exercised on a live OpenAI.Codex 26.707.3748.0 install while preserving local Desktop state
• a few guard checks are intentionally more tolerant of migrated/newer bundle shapes so current Codex builds do not fail the whole repair path on unrelated legacy gates

[dilong888]

Follow-up for Codex Desktop 26.707 mobile remote control:

• Fixes the Connections tab router so Control this PC is not normalized back to SSH after the tab is made visible.
• Reuses code-signing certificates by subject, private-key availability, validity, and Code Signing EKU instead of relying on -CodeSigningCert.

Validated on Windows with OpenAI.Codex 26.707.3748.0: the installed ASAR contains the route marker, the Control this PC entry is clickable, and a previously paired phone can view Desktop sessions and deliver a new message.

Checks: node --check scripts/patch-remote-control-asar.cjs; PowerShell parse validation across scripts/*.ps1; git diff --check.