Harden theme runtime and layout contracts

[junlingf]

What changed

• Adds bounded Home, button, workspace-brand, and Composer layout contracts to the CLI, schema, free themes, Plugin, and runtime.
• Adds transactional macOS lifecycle management, signed Codex process-tree verification, hot switching, and a hardened installer path.
• Fixes inherited Electron CDP listener ownership, renderer theme controls, semantic color mapping, Terminal contrast, Home card classification, and Composer placement.
• Expands security, installation, authoring, and compatibility documentation.

Why

The compatibility runtime needed to support expressive themes without modifying the signed Codex application, while retaining bounded geometry, verified hit targets, safe restore behavior, and actionable diagnostics across Codex/ChatGPT process variations.

Impact

Theme authors can opt into controlled layout customization, users can switch or restore themes from the runtime surfaces, and macOS launches now validate the exact signed Codex process tree before injection.

Checks

• npm test: 126 passed, 1 Windows-only skipped.
• npm run test:themes: 16 strict theme validations passed.
• npm run test:package: standalone npm install passed.