test: enforce the MVP release gate (#16)

[Traviinam]

Summary

Enforce the MVP release gate for AC-01 through AC-24, including supported-scale performance, accessibility, compatibility, security, race, and recovery evidence.

The Codex adapter now supports the exact candidate profile 26.901.41600 (build 7982), Chromium 152.0.7977.64. Direct HTTP iframe navigation is blocked by this build's CSP, so the adapter creates a sandboxed blank frame and loads launcher-owned HTML through CDP Page.setDocumentContent. A visible Git entry opens the full surface; native navigation restores the original content, and renderer reload remounts the entry and document.

• Keep allow-scripts sandboxing, instance-token protocol access, exact host/project binding, and scoped CSP cleanup.
• Permit opaque-origin CORS for public JavaScript/CSS assets only; bootstrap and fallback HTML remain unreadable cross-origin.
• Confirm frame identity and nonce-based document readiness; deduplicate reload delivery and fall back safely on failure.
• Update the macOS CI reference and manual VoiceOver/keyboard wizard to build 7982.
• Preserve standalone fallback and all manual evidence requirements. No standalone-only scope waiver was applied.

Verification

• npm run format:check, npm run lint, npm run build (including typecheck), and wizard syntax check passed.
• Full suite in the final local release-gate run: 400 tests passed.
• Local integrated smoke on macOS 26.6.2/build 7982: visible single Git entry; full UI and repository snapshot; actual Stage/Unstage Index changes; repeat opening without duplication; automatic renderer-reload recovery with readiness; native navigation restoration and cleanup.
• Final local reference performance: shell 31.66 ms; Selected Worktree 936.447 ms; full snapshot 866.844 ms; external change 1162.7 ms; loaded interaction 11.422 ms. All budgets passed.
• Security review identified an overbroad CORS policy during development; the final policy and loopback regression test address it.

Remaining release blockers

This PR remains a draft. The final local gate fails only the codex-host-smoke and voiceover-keyboard-smoke manual evidence rows. Automated smoke does not substitute for the required human checklist. Complete the updated wizard, commit the durable source-revision-bound evidence, and rerun the gate before merging. Current GitHub CI must also be checked on the updated head.

Earlier isolated test runs showed intermittent timing/AC-08 failures; the final complete local gate's test process passed. Keep CI verification on the updated head as a merge prerequisite.

Tracks #16