[codex] Harden diagnostics, pause policy, and contract drift gates

[haasonsaas]

Summary

• Adds a redacted local diagnostics report, queued-batch summaries, and menu actions to open diagnostics or delete queued fallback batches.
• Adds scheduled pause windows from Chronicle policy, pause precedence helpers, heartbeat pause state, and launch-at-login via native SMAppService.
• Adds display metadata on frames, captureWindow encoding, adaptive OCR persistence budgets, a strict mock Chronicle/Secret Broker harness, golden contract fixtures, and CI fixture validation.
• Documents diagnostics, contract harness usage, release/update-channel evidence, secret-scrub posture, and the Codex Chronicle comparison.

Closes #31.
Closes #32.
Closes #33.
Closes #35.
Closes #36.
Refs #34 and #39 for remaining multi-display/concurrent-capture and broader Chronicle parity work.
Refs #24 and #25; those still require Developer ID/notary credentials and interactive TCC hardware evidence.

Validation

• swift build -Xswiftc -warnings-as-errors
• swift test
• xcrun swift-format lint --strict --recursive Sources Tests Package.swift
• python3 scripts/mock_chronicle.py --self-test Tests/Fixtures/chronicle
• shellcheck scripts/package_app.sh scripts/permission_smoke.sh
• scripts/package_app.sh
• git diff --check
• actionlint .github/workflows/ci.yml .github/workflows/package-release.yml

[cursor]

PR Summary

Medium Risk
Touches capture pause control flow, Chronicle wire contracts/JSON encoding, and packaging artifacts; regressions could impact when capture runs or how batches/heartbeats are accepted server-side.

Overview
Adds a redacted local diagnostics report and expands the menu bar with actions to open diagnostics, delete queued fallback batches, and toggle launch-at-login via SMAppService.mainApp.

Extends the Chronicle contract and runtime behavior to support scheduled pause windows with explicit precedence (manual > scheduled > server policy), includes pause state in HeartbeatRequest, and switches Chronicle control JSON date handling to ISO-8601.

Enhances captured/batched data by adding display metadata to frames, adding a captureWindow to batch payloads, and introducing an adaptive OCR persistence budget that reduces stored OCR text under backlog/backpressure.

Introduces a strict scripts/mock_chronicle.py contract harness with golden fixtures validated in CI, plus release packaging now emits and ships a signed dist/update-channel.json (included in checksums/artifacts) along with new documentation covering these changes.

^{Reviewed by Cursor Bugbot for commit 937dcaa. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is ON, but it could not run because the branch was deleted or merged before autofix could start.}

^{Reviewed by Cursor Bugbot for commit 937dcaa. Configure here.}