Implement the versioned loopback protocol and security boundary

[codeacme17]

Tracks #1.

Summary

Implement the versioned loopback protocol and security boundary that separates the sandboxed UI from local filesystem, process, and Git authority.

Scope

• Bind the local server to 127.0.0.1 on an ephemeral port.
• Generate a per-launch 256-bit instance token and use it in an unguessable URL path.
• Add runtime-validated schemas for session metadata, snapshots, diffs, branches, Commit Drafts, commands, operations, typed outcomes, native actions, and SSE invalidations.
• Implement endpoints for session, snapshot, on-demand diff, branch search, Commit Draft update, command submission, native actions, operation recovery, and SSE events.
• Permit the opaque iframe's Origin: null only after token and protocol validation; reject other unexpected origins and non-loopback peers.
• Enforce body/output limits, protocol-version negotiation, opaque IDs, duplicate command detection, and structured error responses.
• Prohibit raw executable names, Git argument arrays, absolute paths, refspecs, and arbitrary URLs from client requests.
• Add central diagnostic redaction for credentials, URL userinfo, tokens, authorization material, and secrets.

Acceptance criteria

• The standalone and Codex surfaces use the same protocol package and runtime schemas.
• Malformed, oversized, cross-version, stale-token, unexpected-origin, and duplicate-command requests fail without invoking a product operation.
• Native actions accept only allow-listed tagged variants against server-issued opaque targets.
• SSE sends revision/progress invalidations, not authoritative incremental Git-state patches.
• Normal logs do not contain the instance token or test credential fixtures.
• The server can restart cleanly and exposes no non-loopback listener.

Out of scope

• Real Git discovery or mutation behavior.
• User authentication, cloud services, or a persistent database.

Dependencies

• Bootstrap the TypeScript workspace and standalone runtime #3.

Verification

• Protocol contract tests, malformed-input tests, origin/token tests, redaction snapshots, and listener inspection on macOS.