Summary

Prepare CX-Codex 2.5.6 from the three green post-2.5.5 improvements:

• stronger long-running chat soak coverage for replay sequence and public auth
• phone access moved ahead of package usage and permission controls
• loopback-only QR pairing with password kept outside the QR and URL

Also refresh the 2.5.5 formal-release status and current newcomer/open-source readiness notes.

Verification

• npm.cmd run verify:release -- -SchemaAudit skip
  • governance passed
  • frontend and CLI builds passed
  • frontend normalizers and server modules passed
  • CLI and CJS launcher smoke passed
  • Release zip/checksum smoke passed
  • npm package smoke passed
• the implementation PRs Harden long-running chat stability soak #35, Prioritize phone access in settings #36, and Add local QR pairing for phone access #37 passed Linux build and Windows bootstrap smoke
• local schema audit completed in warn mode before this release PR; upstream drift remains candidate-reviewed and this version does not expand App Server compatibility claims
• git diff --check

Release plan

After this PR is green and merged:

1. run the clean-tree release gate on merged main
2. push tag v2.5.6
3. wait for the Release workflow
4. verify all published checksums and asset versions
5. install/upgrade from the public Release archive and verify local health, Quick Tunnel auth, QR pairing, and cleanup