Configure Codex watchdog on install and add protected streaming launcher

[Wibias]

Problem

github-delivery v0.2.0 shipped the watchdog implementation, but a normal install did not configure lifecycle hooks and ordinary Codex launches did not pass through the streaming boundary. A user could therefore install successfully and still hit the exact repeated in-turn Let me check... failure.

Fix

Normal install + trust-aware hooks

• The normal Codex install/upgrade path now preflights and configures GitHub Delivery's PreToolUse, PostToolUse, Stop, SubagentStop, and SessionEnd hooks.
• Existing unrelated hooks are preserved, hook configuration is backed up before changes, malformed/symlinked config fails closed, and repeated installation is idempotent.
• Configured non-managed hooks are not reported active until the exact unchanged definition has been explicitly trusted through Codex's /hooks flow.
• A fresh hook configuration therefore reports none / hook_trust_required rather than falsely claiming lifecycle enforcement.
• After trust, node scripts/install-skill.mjs --hook-trust-verified --apply performs a same-version activation refresh without reinstalling the skill.
• GitHub Delivery never enables Codex's dangerous hook-trust bypass by default.

Protected streaming launcher

• Add scripts/codex-with-watchdog.mjs for the exact failure that must be interrupted while assistant text is still being generated.
• The real codex app-server remains on stdio. An authenticated loopback WebSocket bridge is placed between it and a normal codex --remote client.
• The bridge uses an in-memory bearer token, accepts one client, validates the WebSocket v13 upgrade, bounds frames, fails closed on malformed traffic, and suppresses only the watchdog's private interrupt response.
• The launcher owns --remote and --remote-auth-token-env, so callers cannot accidentally bypass the protected boundary.
• The launched process tree declares SHIPPING_GITHUB_PROGRESS_WATCHDOG=stream; ordinary codex and IDE sessions are not silently or falsely marked as streaming-protected.
• The exact observed phrase family (Let me check the type, Let me check the NOUS_DEF type, Let me check the OAuthProviderDef type) is exercised through the protected bridge and must trigger exactly one private turn/interrupt before 500 emitted characters.

Runtime truth

• Add a non-sensitive activation receipt under the active Codex home.
• Effective mode is strongest verified only: controlled stream > explicitly confirmed trusted hooks > none.
• A current protected-session environment declaration overrides stale machine-wide activation state.
• Receipt state contains no prompts, conversations, bearer tokens, or raw tool arguments.

Safety

• GitHub mutation authority, freshness, review, CI, security, and final-evidence rules are unchanged.
• Hook trust is not bypassed.
• Malformed host hook configuration is rejected during preflight before skill replacement.
• The protected bridge is loopback-only and bearer-authenticated in normal launcher operation.
• Codex currently documents App Server and WebSocket transport as experimental and unsupported for production workloads; this PR presents the streaming launcher as the strongest current Codex boundary, not as a production-stable host API.

TDD / regression coverage

• RED captured on test-only head ca5546f0f0c06c42aa2ccb14fd62d8f944bb5459 before the normal installer supported watchdog activation.
• Added install/configuration, exact-hook-trust, trust-invalidation, same-version activation refresh, activation receipt privacy/idempotency, persisted runtime capability, current protected-session declaration, remote-boundary ownership, loopback bearer authentication, and exact in-turn incident regressions.
• The incident test sends realistic item/agentMessage/delta notifications through the protected streaming boundary and requires one turn/interrupt before 500 characters.

Documentation

• README.md
• INSTALL.md
• references/agent-progress-watchdog.md
• references/runtime-capabilities.md
• docs/superpowers/specs/2026-08-11-watchdog-activation-design.md
• docs/superpowers/plans/2026-08-11-watchdog-activation.md

Verification

• Final verification was re-read on the exact PR head after implementation and documentation stopped changing.
• CI passed across the required Node 22/24 Ubuntu, macOS, and Windows matrix.
• CodeQL passed.
• Architecture Contracts passed.
• Dependency Review passed.
• The PR was marked ready for review only after that exact-head verification.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.