Harden Codex web for authenticated tunnel deployments

[thisistoni]

Summary

• enforce exact browser Origin and Host checks for IPC and uploads
• bound WebSocket payloads, IPC queues, message ports, and upload storage
• restrict browser-visible workspaces and files while preserving Codex backend access
• pin and verify the desktop archive and fail closed on update signature errors
• update vulnerable dependencies and document authenticated loopback tunnel deployment
• add a macOS Cloudflare operations guide covering setup order, verification, stop/restart, and complete removal

Verification

• npm run check
• npx prettier --check README.md docs/macos-cloudflare.md
• uv run --locked --project scripts/fetch_updates python -m unittest discover -s scripts/fetch_updates -p test_*.py
• npm audit (0 vulnerabilities)
• pinned runtime download, hash check, OpenAI signature check, extraction, and build
• live loopback tests for trusted/untrusted Origin, Host, files, uploads, and malformed IPC
• rendered UI verified against the signed local Codex app-server