feat: add audited Codex Image 2 WeChat reports

[kdnsna]

Summary

• turn WeChatPilot into a one-way, read-only Codex task observer for a home Mac
• render numbered, editorial-style 1080 px long-image reports with Codex Image generation and send text plus image receipts to WeChat
• add detailed success, skipped, failed, recovery, and health report evidence instead of sparse one-line cards
• harden scheduling, idempotency, retry, stale-lock recovery, QR login polling, redaction, and delivery audit ledgers
• add project branding, contribution templates, ownership metadata, and CI for the private GitHub repository

Why

The goal is to make WeChat a trustworthy monitoring destination for scheduled Codex work. It reports what ran, what evidence was produced, and what action is recommended, while deliberately excluding WeChat-triggered Codex, shell, or Mac remote control.

Safety boundary

• WeChat delivery is outbound only.
• Codex report generation is ephemeral, read-only, non-interactive, and receives only the ranked candidate bundle over stdin.
• Secrets, credentials, cookies, authorization headers, WeChat context, local paths, and runtime reports are redacted or excluded from Git.
• vendor/cli-in-wechat remains a pinned QR-login/context/proactive-send adapter; its upstream remote-control entry points are not started or reused.

Notable fixes

• preserve large WeChat message_id values as identifiers instead of unsafe JavaScript numbers
• keep the QR status server alive long enough for WeChat's 15/30-second long polling
• populate every report branch with evidence and next actions
• make CI build and apply the audited QR timeout patch before tests
• require explicit confirmation before installing or reloading the LaunchAgent in a new environment

Verification

• npm test -- --reporter=dot --maxWorkers=1: 65 files, 645 tests passed
• npm run typecheck: passed on Node 22
• npm run build: passed on Node 22
• npm --prefix vendor/cli-in-wechat test: 81 tests passed
• plutil -lint launchd/com.kdnsna.daily-tech-digest.plist: OK
• git diff --cached --check: passed before merge commit
• root production dependency audit: 0 vulnerabilities
• CI workflow YAML parse: passed

Known dependency note

The pinned upstream adapter currently reports one high-severity undici advisory set and one low-severity esbuild advisory. WeChatPilot does not enable the affected upstream WebSocket or development-server entry points. This draft keeps the upstream pin intact so a dependency update can be reviewed and tested separately instead of silently changing the adapter snapshot.

Operational result

The local LaunchAgent schedule remains 08:00. End-to-end checks produced detailed numbered 1080 x 2400 report cards and recorded accepted text/image delivery receipts. Runtime state, QR images, logs, and generated output are intentionally untracked.