feat: standalone coding workbench with verified patch delivery

[Ai-Eastern]

The existing controller requires configured Codex Desktop tasks to perform coding work. This change adds a standalone browser and CLI workflow: submit a bounded task against a Git repository, run Codex in a detached worktree, execute fixed acceptance commands, and inspect a hash-bound patch before deciding how to merge it.

• Add npm start and npm run agent for real tasks, events, cancellation, failure output, explicit repair, and diff download. Keep the existing Desktop routes separate.
• Integrate the real Codex CLI through stdin and JSONL, with bounded logs, execution timeouts, process-tree cancellation, and parent task/Git environment filtering.
• Reuse the existing workflow and SQLite evidence checks. Preserve the source checkout, enforce an exact write set, freeze selected acceptance files, keep failed attempts, and export patches through a temporary Git index. Fix the old repair path reusing the previous attempt's receipt.
• Add an opt-in real-model smoke command, supporting mechanism fixtures, bilingual setup documentation, screenshots, an evidence map, and Windows/Linux CI. The read-only Evidence Lab is supplementary.

Validation:

• GitHub Actions on 1a23e19: Windows and Ubuntu jobs passed for both push and pull-request runs, including the full test suite and mechanism evaluation. PR workflow run.
• Windows / Node 24.18.0: npm test — 204 tests, 203 passed, 1 existing symlink-permission skip, 0 failed.
• Browser checks at desktop and 390px widths: submission, actual Git/acceptance, diff download, explicit repair, acceptance cancellation, Unicode, text-only event rendering, and invalid input. These checks inject a test coding executor.
• One real Codex CLI task: fixed a normalization function, passed two frozen Node tests, reached READY_FOR_REVIEW, and left the source implementation and Git status unchanged. This is a single integration smoke, not a coding benchmark; the provider's model identity was not observed.
• Targeted regressions cover malformed URLs without server termination, altered acceptance receipts, interrupted checks, retained failure evidence, and recovery of a patch written before its manifest update.

The local route currently uses one coding executor per task and does not automatically write knowledge back. Worktrees and hash checks are application controls, not a hidden-test or OS isolation guarantee. Acceptance commands and the target repository must be trusted. Dependencies in the new worktree still need preparation. No automatic commit, merge, or push is added to task execution. The existing private-repository and license status is unchanged.