Support bring-your-own Lakebed deployments - #1

Summary

Make Codex Artifacts safe and straightforward to deploy from a fresh clone into a user-owned Lakebed account.

Changes

• Add a guided setup command that creates local secrets, authenticates with Lakebed, deploys an owned capsule, and verifies its health.
• Bind owner and recipient invitations to durable Lakebed identities, with revocation when access rules change.
• Harden publisher configuration, replacement semantics, iframe isolation, and capsule capacity enforcement.
• Add public-release safeguards, CI, dependency updates, contribution and security guidance, and an MIT license.
• Reorganize the README around the complete new-user journey from deployment through the first private artifact.