fix: support ChatGPT desktop app on Windows

[yzs15]

Summary

• Adapt Windows detection, installation, and launch handling from the legacy standalone Codex package to the ChatGPT desktop app while retaining old Codex package compatibility.
• Validate exact protocol, package, AUMID, signer, and process identity around activation; harden system-binary resolution and installer integrity verification.
• Surface actionable install, scheme, and launch diagnostics across launcher and onboarding UI, sanitize frontend SSE errors, and add regression and Windows source-contract coverage.

Security

• Reject fuzzy package/process matches, malformed or mismatched AUMIDs, untrusted protocol handlers, and untrusted installer identities.
• Use trusted absolute system executable paths where required and scope launch confirmation to the current Windows user/session.
• Avoid exposing tokens, user paths, registry data, or raw winget/PowerShell output through onboarding SSE errors.
• Spec, implementation plan, and final code were reviewed in one persistent GPT-5.5/xhigh Codex session. Final review: READY with no Critical, Important, or Minor findings.

Test plan

• go test -count=1 ./...
• UI Vitest: 9 files / 100 tests
• make ui-build
• VS Code extension TypeScript compile
• GOOS=windows GOARCH=amd64 go build ./...
• Cross-compile Windows test binaries for internal/codexdesktop and internal/browser
• Race tests for 12 affected packages
• go vet ./...
• bash -n scripts/*.sh
• Selected Windows e2e source-contract tests
• git diff --check
• Live Windows acceptance: new ChatGPT package, legacy Codex package, broken/missing scheme, invalid handler/AUMID/PFN/ApplicationId, activation and process-confirmation failures, reparse/final-path behavior, and live Authenticode/revocation/root-pin validation

The current verification host is Linux and has neither pwsh nor powershell.exe; live Windows acceptance remains a release prerequisite.

Closes #23.