[codex] Harden protocol consistency and desktop bridge security

[devteapot]

Summary

Stacked on #71. Extracts the non-Swift work that was previously mixed into the Swift SDK PR.

What changed

Protocol consistency

• Requires patches caused by an invocation to reach the invoking connection before its result.
• Aligns TypeScript, Python, Go, and Rust provider behavior for successful, accepted, and error results.
• Adds focused ordering tests.
• Clarifies subscription identity, salience defaults, transient changed behavior, stable sibling IDs, patch terminology, and content-reference resolution.

Desktop and extension security

• Authenticates the desktop bridge with a persisted high-entropy pairing token.
• Rejects web-page origins at the bridge upgrade boundary.
• Uses constant-time token comparison and never echoes or logs the secret.
• Adds desktop copy/regenerate controls and extension pairing states.
• Requires explicit approval for cross-origin web-discovery targets.
• Attributes provider identity from the connected provider's hello, not page-controlled metadata.
• Adds bridge-authentication and origin-classification tests.

Stack

• Base: [codex] Add Swift SDK feature parity #71 (codex/swift-sdk-feature-parity)
• This PR contains no packages/swift/** changes.
• The new Swift SDK already implements the corresponding invoke-ordering and transport/discovery hardening as part of its initial implementation; this follow-up aligns the existing SDKs, specification, desktop app, and extension.
• After [codex] Add Swift SDK feature parity #71 merges, this PR can be retargeted to main.

Validation

• Swift base: swift test — 77 passed
• TypeScript core ordering: 2 passed
• Go SDK: go test ./... passed
• Python server: 18 passed
• Rust ordering: 2 passed
• Extension security tests: 16 passed
• Extension typecheck passed
• Desktop frontend typecheck passed
• Desktop bridge Rust tests: 18 passed
• Docs generated-content check passed