fix(supervisor): require V8 JIT entitlement

[shiny-code-bot]

Summary

• require the managed Codex Lab engine to carry com.apple.security.cs.allow-jit
• enforce the entitlement both during supervisor installation and in the generated launchd runner
• cover valid, missing, false, and live generated-runner verification paths

Why

The issue #367 parity canary proved a signed arm64 engine with no entitlements crashes on its first GPT-5.6 Luna tool call with V8's Failed to reserve virtual memory for CodeRange fatal error. Re-signing the identical binary with the repository's existing allow-jit entitlement made the same tool turn complete successfully, and the repaired supervised engine completed the mapped-worktree Luna turn in 8.6 seconds.

This patch makes that signing requirement fail closed instead of allowing a provenance-valid but tool-crashing engine to launch.

Validation

• python3 -m unittest scripts.codex_lab_package.test_supervisor
• python3 -m unittest discover -s scripts/codex_lab_package -p 'test_*.py' — 75 tests
• git diff --check
• physical macOS 27.0 arm64 canary: unentitled engine reproduced the CodeRange crash; the identical allow-jit-signed engine completed a GPT-5.6 Luna pwd/README tool turn
• generated supervisor runner accepted the entitled engine and rejected the preserved unentitled backup
• independent breaking-change, context, change-size, and testing reviews found no remaining issues

Scope

This intentionally rejects existing managed engines that lack the required entitlement. The supported install/update provisioning work remains tracked in #462; this change prevents such engines from being treated as healthy in the meantime.

Refs #367
Refs #385
Refs #462