Add macOS one-click release

[Alert886]

What changed

• Added a one-click macOS installer and reversible restore command.
• Added secure Codex bundle discovery, signature validation, loopback CDP ownership checks, and exact injector cleanup.
• Reuses a compatible signed Codex Node.js runtime or downloads a SHA-256-verified portable Node.js fallback.
• Added a permission-preserving macOS ZIP build on GitHub macOS runners.
• Updated documentation and bumped the release to 0.2.0.

User impact

Apple Silicon and Intel Mac users can install the same usage meter and quick-control dock without modifying the Codex app bundle.

Validation

• npm.cmd test (16/16)
• npm.cmd run check
• bash -n for all macOS commands and scripts
• Windows v0.2.0 package build