Provision signed engine through Codex Lab installer

[shiny-code-bot]

Summary

• add a schema-v2 managed-engine artifact contract with stable Developer ID identity, TeamIdentifier, binary digest, provenance, and required JIT entitlement
• sign and verify the release engine on the self-hosted macOS runner, then package it beside the app and shim
• provision engine, app, shim, install state, and the launchd supervisor as one rollback-aware install/update transaction
• add supported uninstall with pre-installer engine restoration and managed-target safety checks
• replace manual canary provisioning guidance with the supported install/update/uninstall flow

Validation

• python3 -m unittest discover -s scripts/codex_lab_package -p 'test_*.py' (83 tests)
• ruff check and ruff format --check on changed Python files
• actionlint on both Codex Lab workflows
• prettier --check on changed workflow and Markdown files
• native Developer ID signing probe verified com.shinycomputers.codex-lab.engine, TeamIdentifier MM5YXC7T6E, hardened runtime, and com.apple.security.cs.allow-jit

Refs #462

[shiny-code-bot]

Validation update for head 916cb08e2b4feb282884401321fa06220786013f:

• Exact-head release dry-run succeeded: Actions run 30118793306 built the release CLI, unlocked the runner signing keychain, applied the Shiny Developer ID signature plus hardened runtime/JIT entitlement, verified identity/provenance, packaged the engine, and validated the schema-v2 release set.
• Downloaded engine SHA-256: 94be1671ae1b43d5f18f731820f198ed93dc09055d31d4f1dfae5fb19b3879eb.
• Isolated real launchd canary used dev.everycode.codex-lab.app-server.v1.issue462 on an ephemeral loopback port: fresh install became healthy at PID 83653; forced update became healthy at PID 84382; uninstall removed app/shim/state/service and restored the pre-installer managed engine.
• Repository CI and the PR macOS app artifact build are green.