dsh-codex-connect v0.1.0-alpha.3

Security hardening release. Remote view_image access now permits public HTTP(S) targets only, revalidates every redirect, and pins connections to validated DNS addresses. Local Web OAuth routes now reject non-loopback and cross-origin requests, validate authorization URLs, time out missing challenges, and clean up concurrent waiters. Adds browser account-state tests and build-injected version diagnostics. Defaults remain additive: this release does not change the Harness default model or search route. Verified with 13 test files and 58 passing tests, typecheck, build, and pack validation. SHA-256: f3a927378e37ea804404f94ad6c8039a49545a779ead7a82f1d7ef22bdbe2f49. This GitHub prerelease is not published to npm.