Accept Codex Desktop app-server userAgent

[yvette-carlisle]

Summary

• parse Codex Desktop/... app-server userAgent strings into Codex CLI versions
• add the locally verified codex-cli 0.137.0-alpha.4 compatibility guard entry
• add --allow-unverified-codex for run, serve, and probe so deliberate development-version dogfooding downgrades only unsupported app-server identity to a warning
• keep other app-server capability preflight failures fail-closed and propagate the override through runtime-owned child attempts
• move long Makefile shell logic into scripts/macos/test_decodex_app_stage.sh and keep Makefile tasks as command/dependency wiring
• document the 2026-06-03 compatibility pass and the override boundary in README/spec/plugin skill docs

Verification

• cargo make check-rust
• cargo make decodex-checks
• cargo make test-rust
• cargo make test-decodex-app-stage
• cargo test -p decodex app_server_compatibility_guard --lib
• cargo test -p decodex parses_runtime_unverified_codex_override --lib
• cargo test -p decodex app_server_compatibility_versions_match_spec_table --lib
• cargo run -p decodex --bin decodex -- probe --allow-unverified-codex stdio://
• git diff --check
• semantic drift audit: pass; docs/help/tests/probe evidence match, and STAGE_DIR was only an internal Makefile variable moved into the macOS script while DECODEX_APP_STAGE_DIR remains documented