Persist themes after macOS login

[erickkkyt]

What changed

• add an explicit --takeover-at-login option for LaunchAgent installs
• safely replace an already-running official Codex instance only during a bounded macOS startup window
• keep default behavior non-disruptive and fail closed for unknown or multiple app instances
• launch the verified official app through LaunchServices with loopback-only CDP
• preserve the option across agent upgrades
• update catalog commands, README, install docs, changelog, schema, and generated metadata

Safety

• opt-in only
• 120-second boot window, one attempt per agent lifetime
• validates bundle ID, Team ID, code signature, version, exact PID, and loopback port
• uses normal application quit; no killall, pkill, SIGKILL, app-binary patching, or separate user profile
• multiple instances and exit-verification failures fail closed

Verification

• pnpm check: 34 test files / 266 tests passed
• 12 themes validated
• TypeScript and production Vite build passed
• pnpm audit --prod --audit-level moderate: no known vulnerabilities
• git diff --check passed

A physical reboot test remains intentionally documented as pending; the new behavior is covered by deterministic startup-window and lifecycle tests.