[codex] Fix v1.5.7 installer and theme verification issues

[Fei-Away]

Summary

Fixes the six reported client issues for the v1.5.7 release batch:

• [Bug]: 26.721.x 首页 home-icon 非稳定渲染 → homeRoute=true 但 homePresent=false → Initial theme verification failed（1.5.6 仍存在） #306: macOS home verification now falls back from a late home-icon selector to the already-resolved semantic [role="main"] home route.
• [Bug][macOS]: Light full task mode inherits white Markdown text #309: wide full-mode Markdown now uses the Dream Skin theme text token in light shell mode.
• [Bug]: 似乎并不是每一次都能稳定启动。用了custom的设置，无法一键换肤，也不是每次都能稳定启动皮肤 #307/[Bug]: 导入主题压缩包报错，如果手动解压放入文件夹样式错乱 #312: Safe CSS now accepts bounded backdrop-filter: blur(var(--ds-theme-surface-blur)), matching Studio/community theme packages without allowing arbitrary filter functions.
• [Bug]: 似乎并不是每一次都能稳定启动。用了custom的设置，无法一键换肤，也不是每次都能稳定启动皮肤 #307: Windows home verification gets the same late-home-icon fallback as macOS for Codex Desktop 26.721.x startup stability.
• Win10 安装 V1.5.6 失败，弹窗报错 #313/[Bug][Windows] v1.5.6 installer cannot auto-load Microsoft.PowerShell.Security for Get-AuthenticodeSignature #314: Windows Node Authenticode verification explicitly loads Microsoft.PowerShell.Security before calling Get-AuthenticodeSignature.
• Bumps all required version sources to 1.5.7.

Validation

• NODE=$(command -v node) bash macos/tests/run-tests.sh
• node windows/tests/injector-window-readiness.test.mjs
• node windows/tests/injector-bootstrap.test.mjs
• node tools/sync-runtime-assets.mjs --check
• six-version-source Node check for 1.5.7
• git diff --check
• rg found no non-changelog 1.5.6 / v1.5.6 references

Notes

Native Windows PowerShell/installer execution is not available on this macOS host, so the installer module-load change is covered locally by static contracts and must be executed by GitHub Actions on Windows.