Add Approve and Decline to Codex command and Task actions

[safonin]

What changed

Adds Approve and Decline to Codex command, plus a dedicated Task actions selector using the same handler and target settings. A short press answers one pending request.

• Task selected on Stream Deck (default): press a Current or Top task key to bind its exact UUID and show its title on the approval keys. That binding survives manual Codex tab switches. Approval uses local desktop IPC without focusing Codex or generating keyboard input.
• Current dialog (foreground): uses an already-ready Micro connection or the verified native permission card. For Review findings, the user must review and check the acknowledgment in Codex before Approve can activate Continue chat.
• Revalidates the request and target, rejects ambiguous or unsupported requests, and prevents concurrent or duplicate delivery. An uncertain send is never replayed; a bound task cannot fall through to another visible dialog. Blue Sent means dispatch, not successful completion of the underlying operation.
• English, Korean and Russian settings/key copy; existing profile layouts and shortcuts preserved. Generated key previews with synthetic titles.

Why

Fixes #16: existing custom profiles need physical Approve/Decline controls. Both selectors expose identical behavior. This uses an internal, versioned desktop IPC protocol and currently supports explicitly selected local tasks. Automatic global selection of the only pending request, remote approvals, Priority and Fixed task are not included. The branch starts after merged #17, #18 and #19.

Hardware verification

Current local version inventory:

• macOS: 26.6.2
• Codex Desktop: 26.901.51231, build 8109
• Stream Deck software: 7.7.0 installed
• Stream Deck model: Neo

Read-only live IPC checks during development verified initialization, owner discovery and request snapshots. Foreground Approve was user-tested on Neo in the development build. Physical background Approve/Decline remains unverified, and this extracted build has not been installed on the device. No live approval decisions were sent by automated checks.

Checks

• pnpm run build — universal arm64/x86_64 helper and byte-identical bundled modules.
• pnpm run audit — release audit and license policy passed for 80 dependency versions; dependencies and lockfile unchanged.
• pnpm run check — 274 plugin tests + 11 reference-protocol tests, no failures or skips, native self-tests, localization/docs and Stream Deck validation passed.
• Both selectors tested with Approve/Decline and both targets, including settings-change cancellation; plugin fixtures run under the live-I/O denial guard.
• Private task titles, secrets and hardware identifiers excluded.
• English and Korean public-behavior documentation updated, including IPC data handling and generated key previews.