Complete Windows 0.2.10 support and release hardening

[sheacoding]

Summary

• complete the Windows 11 x64 Microsoft Store Codex adapter with package identity, AUMID activation, loopback CDP ownership checks, cached discovery, and transactional recovery
• harden OAuth with single-flight GitHub/Google flows, deep-link error handling, encrypted session/PKCE storage, refresh retry behavior, and explicit disabled/error UI states
• make the Electron shell and theme gallery responsive from 680×480 through maximized/4K windows, preserve Windows title-bar controls, and restore branded taskbar/app icons
• support .exe and npm .cmd Codex CLIs with hidden child processes and clean server reconnection after path changes
• add Windows NSIS packaging, protocol/file associations, startup cleanup, release size/ASAR/signing gates, CI workflow, optimized WebP assets, and GEB L1/L2/L3 maps

Root causes addressed

The Windows implementation previously mixed slow polling, path-only identity checks, overlapping status work, non-transactional theme startup, viewport-only responsive breakpoints, and authentication state split across runtime and UI. This PR consolidates those behaviors behind platform, auth, and renderer boundaries instead of patching individual call sites.

Validation

• npm run typecheck — pass, including Astro diagnostics (0 errors/warnings)
• npm test — 195/195 pass
• npm run build — pass
• npm run build:web — pass, 27 pages
• npm run dist:win:dir — pass
• unpacked Windows size: 300.2 MiB (limit 350 MiB)
• ASAR size: 4.3 MiB
• maximized Electron gallery: verified at 1707×1019 with five-column fluid tiling

Release gates still required

This remains a draft until the upstream repository supplies VITE_SUPABASE_URL, VITE_SUPABASE_ANON_KEY, VITE_COMMERCE_API_URL, WIN_CSC_LINK, and WIN_CSC_KEY_PASSWORD. The formal installer command intentionally fails without the public runtime configuration; locally produced executables are unsigned. Windows Sandbox install/upgrade/uninstall, real GitHub/Google OAuth, payment sandbox, and final Authenticode/SmartScreen checks must pass before tagging v0.2.10.

[vercel]

@sheacoding is attempting to deploy a commit to the canghe's projects Team on Vercel.

A member of the Team first needs to authorize it.

[freestylefly]

Hi @sheacoding, thank you for the substantial work on Windows support.

The repository is now at v0.2.15, while this PR still targets the v0.2.10 release line. It is currently 14 commits behind main and has merge conflicts. Before we continue the review, please update the branch onto the latest main, resolve the conflicts, and refresh any version or release assumptions.

Please also provide fresh CI results and verification evidence for the remaining Windows release gates listed in the PR description. Since the changes include assets/windows/codex-activator.exe, please document a reproducible build process and show that the committed binary matches the corresponding source. Windows Sandbox install/upgrade/uninstall, real OAuth and payment sandbox flows, and Authenticode/SmartScreen checks should also be covered before the PR is marked ready for review.

The current Vercel failure appears to be a team deployment authorization issue; we will evaluate that check separately after the branch is updated. Thanks!