fix: open project starters in Codex mode

[CheeseGrinder231]

Summary

• route the L3 Session Starter to Codex's native new-task page for the selected project
• explicitly activate Codex mode first, even when Chat or Work was last selected
• follow Codex Desktop's effective switchToMode2 shortcut, including user overrides
• remove the separate thread/start path that could create an empty task before Codex Desktop loaded it

Root cause

The project inventory and controller selector worked. Two post-release assumptions did not:

1. A thread created by a separate App Server process was not necessarily loaded in Codex Desktop when its deep link arrived.
2. codex://new?path=... selects the project but inherits the product mode that Codex Desktop last used, so Chat stayed Chat.

Codex Desktop now owns page creation through its native project route. Before opening that route, Agent Controller invokes Codex's app-scoped switchToMode2 command through its configured shortcut (macOS default Control+2).

Safety and configuration

• resolve overrides from Codex's own ~/.codex/keybindings.json only when L3 commits
• target the frozen Codex process, wait for the bounded mode transition, then revalidate exact focus before opening the route
• fail closed when the command is disabled, the binding is unsupported, Accessibility is unavailable, focus changes, or the project disappears
• do not create a task until the user submits the first prompt

Proof

• swift test --disable-sandbox: 101 tests passed; four opt-in live tests skipped by design
• swift build --disable-sandbox: passed
• mode-command contract tests cover default, custom, disabled, unsupported, and malformed Codex keymaps
• prior targeted native-route proof passed and left the recent thread ID set unchanged, proving no empty task was created
• exact-head stable-signed app built, signature requirement verified, and test runtime restarted
• source-size gate: every Swift file remains at or below 500 lines
• iOS frontend tidy strict check: no findings
• git diff --check, credential, model-identifier, added machine-path, and sensitive-file audits: passed

Remaining acceptance

• Physical controller from Chat mode: hold L3, select a project, release, and confirm Codex switches to Codex mode and opens the selected project's blank new-task page.