fix(codex): make MCP bootstrap sandbox-safe

[HelloThisWorld]

Summary

Fixes the Codex plugin MCP startup failure on Windows where the client closed during the initialize response.

The plugin no longer relies on Codex expanding ${PLUGIN_ROOT} in MCP argv. A small bootstrap locates the matching installed plugin in Codex's cache, prefers the newest matching installation, and memory-loads the launcher. The launcher then memory-loads the bundled MCP server so Node does not perform the Windows sandbox-denied realpath walk through the user-profile parent directories.

Regression coverage now exercises the real .mcp.json command, nested project paths containing spaces, multiple cached plugin versions (including a broken stale version), clean stdio shutdown, and useful failure diagnostics.

Root cause

Codex CLI 0.151.0 passed ${PLUGIN_ROOT}/dist/mcp-launcher.cjs literally and did not provide PLUGIN_ROOT to the MCP subprocess. After locating the installed bundle, launching it as a normal Node entry path could still fail under the Windows Codex sandbox while Node resolved user-profile parent directories. Either failure closed stdio before MCP initialization completed.

Validation

• pnpm lint
• pnpm typecheck
• pnpm build:plugin
• pnpm test — 215 files passed; 2,870 tests passed; 2 skipped
• pnpm test:perf — 3 files and 19 tests passed
• pnpm check:public-contracts
• All template, registry, extension, MCP-doc, security, example, and smoke gates
• Claude plugin isolated bundle — 15 checks passed
• Codex plugin isolated bundle — 16 checks passed
• Codex plugin reproducibility and current-CLI validation
• Live Codex host validation after a cache-busted reinstall: list_mcp_resources(server=specbridge) completed and returned specbridge://workspace and specbridge://verification/rules

Checklist

• pnpm lint, pnpm typecheck, and pnpm test pass locally
• pnpm check:public-contracts passes; no public contract changed
• User-visible behavior is documented in CHANGELOG.md
• CHANGELOG entry added
• Everything is in English
• Fixtures are synthetic; no employer or client proprietary content
• No credentials, tokens, or secret values appear in the diff or test output

Security invariants

This changes the plugin/MCP process-loading boundary and preserves the threat model's T09/T13 invariants: the server still receives the active project root separately from the trusted installed bundle root, stdout remains protocol-only, project writes stay governed by the existing workspace/protected-path checks, and candidate cache entries must match both the SpecBridge manifest identity and the exact configured bootstrap source. No arbitrary workspace path, shell, credential, network, approval, or write capability is added.