Connect the desktop launcher to the supervised websocket engine

[cbusillo]

Summary

• replace local PID-daemon selection with CODEX_APP_SERVER_WS_URL=ws://127.0.0.1:4766/rpc
• fail closed unless the canonical supervisor runner validates, launchd owns the live PID, the managed engine command/executable match exactly, and that PID owns the loopback listener
• keep CLI/force/local-daemon overrides explicitly empty so the official app selects websocket for the local host
• make live smoke prove exact GUI environment through KERN_PROCARGS2, websocket initialize logs, managed executable identity, and absence of a persistent bundled stdio fallback
• share endpoint constants with the supervisor and document that signed release provisioning remains tracked separately in Provision signed engine and supervisor through installer #462

Validation

• uv run python -m unittest discover -s codex_lab_package -p 'test_*.py' (73 passed)
• just fmt
• static smoke of /tmp/Codex Lab Websocket.app against source ee84ba5267e5a9e71c0e114def2c5b87f92f9fda
• live macOS canary after launchd restart: service PID 69715 -> 96852; ChatGPT initialized against PID 96852 over websocket with exact empty override variables and no persistent bundled stdio server
• launcher correctly refused to start while the official app was already running

Refs #459, #385, and #462.