v0.1.2 — fix #2 missing repair script + restore C4 hotfix bundling

Premise

Guardian assumes the user has already installed @openai/codex via
npm install -g @openai/codex (that is the prerequisite for needing
this tool at all). The release zip therefore ships only guardian.exe,
the trusted repair script, and the project docs — never a copy of
codex.exe. The slow-path (C4) launcher patch falls back to the user's
own vendor/<triple>/codex/codex.exe from the npm install when no
vendor-hotfix/... is staged.

Fixes

• Closes #2 — guardian repair codex --confirm no longer aborts with
  trusted repair script is missing: ...\.codex\tools\repair-codex-resume.ps1
  on a freshly-installed machine. The trusted PowerShell repair script is
  now embedded into guardian.exe via include_str! and materialized to
  <codex_home>/tools/repair-codex-resume.ps1 on first launch (and
  defensively before the C2 repair branch). Existing operator-customised
  scripts at that path are preserved.

Changes

• package-release.ps1 now stages tools/repair-codex-resume.ps1 inside
  the release zip as a defense-in-depth copy of the trusted script.

What's in the zip

guardian-v0.1.2-windows-x64.zip (~2.21 MB) contains:

• guardian.exe
• README.md, CHANGELOG.md, LICENSE
• tools/repair-codex-resume.ps1

Verifying the download

sha256sum -c SHA256SUMS.txt

Expected hashes (see SHA256SUMS.txt asset):

• guardian.exe — e3e394737609ef481b07dde070409f3bb6227951ef0008882b7b8d672d67848a
• guardian-v0.1.2-windows-x64.zip — 74140395014d5617b0831570c6544f7b326acc3f56cc85300cb32a1fcac48e64

Quickstart

1. Make sure codex is installed: npm install -g @openai/codex
2. Download guardian-v0.1.2-windows-x64.zip, extract anywhere
3. Run guardian.exe repair codex --confirm (or guardian.exe gui /
   guardian.exe tray for the windowed experience). The trusted repair
   script is laid down automatically — no manual setup required.