fix(safe-css): accept registered blur variable

[axdlee]

Summary / 摘要

• Fix the client Safe CSS validator rejecting the registered --ds-theme-surface-blur variable inside backdrop-filter: blur(...).
• Keep the existing value boundary intact: only --ds-theme-surface-blur or a bounded 0..20px value is accepted.
• Add a cross-platform regression that accepts the blur variable and still rejects an unrelated registered variable.
• Regenerate byte-identical macOS and Windows validator assets from the canonical runtime source.

Type / 类型

• Bug fix / 缺陷修复
• Feature / 新功能
• Docs / 文档
• Theme / CSS / visual / 主题或视觉
• Scripts / install / restore / 脚本或安装恢复
• Chore / 杂项

Platform / 平台

• macOS
• Windows
• Both / 双平台
• Docs / repo only / 仅文档或仓库元数据

Self-check / 自测

Docs-only / 仅文档

• Links and wording reviewed / 已检查链接与表述

macOS (when code under macos/ changes)

• macos/tests/run-tests.sh passed / 已通过
• Doctor (optional): macos/scripts/doctor-macos.sh
• Live verify (if inject/CSS/start path): verify-dream-skin-macos.sh or Desktop Verify
• Restore / re-apply smoke (if install/restore/start changed) / 若改了安装恢复启动则做过恢复再应用

Windows (when code under windows/ changes)

• Relevant install / start / verify / restore scripts exercised / 已按改动跑过对应脚本
• Environment noted below (OS build, Codex source) / 下方注明环境

User-facing / 用户可见变更

• Updated macos/CHANGELOG.md (and macos/VERSION if release-worthy) / 已更新 changelog（发版时再 bump VERSION）
• N/A — no user-facing change / 无用户可见变更

Security / 安全

• Does not modify official Codex install / asar / signatures / 未修改官方安装与签名
• Does not silently write API Base URL or keys / 未静默写入 API Base URL 或 Key
• CDP remains loopback-oriented (127.0.0.1) where applicable / CDP 仍仅本机回环（如适用）

Notes / 补充

• Root cause: the old outer blur regex stopped at the first closing parenthesis, so the already registered value var(--ds-theme-surface-blur) could never reach the existing variable allowlist.
• RED/GREEN: the new focused test reproduced Safe CSS value is not allowed for backdrop-filter before the fix and passes after the one-line canonical validator change.
• The production public theme package that exposed the issue was revalidated through both platform package validators; both returned format: official and safeCssStatus: validated.
• Local checks passed: Safe CSS 9/9, portable macOS Node 54/54, portable Windows Node 17/17, both injector payload checks, runtime asset sync check, git diff --check, and the applicable macOS repository suite.
• macOS environment: macOS host with Node.js available. Full-Xcode, installed signed-runtime, and Doctor integrations were skipped by their documented environment gates.
• Windows environment: no PowerShell runtime is installed on this macOS host. PowerShell 5.1 and PowerShell 7 execution remain explicit PR CI gates.
• Changelog was intentionally left unchanged in this focused validator patch; maintainers can place the entry in the target release section.