feat(proof): seed provider usage snapshot for proof runs

[Finesssee]

Summary

Adds the CODEXBAR_SEED_USAGE_JSON proof-harness helper so CUA proof captures can drive deterministic tray/menu states without a live Codex account:

• proof_harness.rs: seed DTO mirroring the bridge ProviderUsageSnapshot JSON shape (camelCase), validation (codex-only, warn-and-skip on malformed files — proof runs never crash on the seed), and mapping into the bridge structs. Unit test covers a full seeded snapshot incl. extra rate windows.
• main.rs: seeds the snapshot into the provider cache before the event loop / first WebView read; the cache timestamp counts as fresh so the first refresh-if-stale call does not evict it.
• commands/providers.rs: while a seed is configured, the provider cache is pinned against automatic refresh eviction for the whole run (forced/manual refresh still overwrites).
• AGENTS.md / docs/WINDOWS_PROOF.md: document the variable next to CODEXBAR_PROOF_MODE.

Commands run

• cargo fmt --all
• cargo clippy both manifests --all-targets -- -D warnings
• cargo test --manifest-path rust/Cargo.toml --lib — 1227 passed
• cargo test --manifest-path apps/desktop-tauri/src-tauri/Cargo.toml — 343 passed (incl. new seed test)
• pnpm --dir apps/desktop-tauri test — 257 passed
• pnpm --dir apps/desktop-tauri run build — ok

Testing evidence / notes

• No user-facing behavior change: the seed only activates under the new env var during proof runs, so no CUA desktop proof is attached (dev tooling only; covered by the new unit test).
• Known pre-existing environment flake (not from this PR): the codexbar lib test binary intermittently dies with STATUS_ACCESS_VIOLATION at providers::sub2api::tests::usage_request_includes_days_and_timezone. Verified reproducible on clean origin/main (526ad1b) and passing in isolation / in module-group runs; treat a one-off crash there as a rerun.

Context

Salvaged from an interrupted local session whose checkout was 67 commits behind origin/main. The redundant parts of that session (Codex identity scoping, Claude limits[]-session preference) were discarded — already landed as #276 and #334. This seed feature was the only unique remaining piece; it unblocks deterministic CUA proof for the upcoming upstream 0.49.x–0.50.1 port waves.

[Finesssee]

Thermo-nuclear code-quality review: blocking on the proof-harness structure.

1. proof_harness.rs introduces five Seed* DTOs plus a large manual conversion that mirrors the complete ProviderUsageSnapshot bridge contract. That creates a second schema which must be kept synchronized with every future bridge/rate-window/cost/pace change. Please make the canonical boundary deserializable, or place one reusable conversion beside the bridge types instead of maintaining a parallel contract inside the proof harness.

2. The seed test mutates process-global environment state through unsafe, serializes access with a global mutex, writes a timestamped temp file, and intentionally leaves it behind. Please extract a pure parse_seed_usage_snapshot(&str) function and test that directly, leaving environment/filesystem handling as a thin shell.

This can remove a substantial amount of code and make the feature deterministic without global test state.

[Finesssee]

Follow-up thermo-nuclear review on head d8ce9593: the prior blockers remain unchanged.

• proof_harness.rs still mirrors the bridge contract through five Seed* DTOs and a large manual conversion, growing the file from roughly 405 to 766 lines. Please establish one canonical deserialization/conversion boundary instead of maintaining a parallel snapshot schema.
• The seed test still mutates process-global environment state through unsafe, serializes with a global mutex, writes a timestamped temp file, and deliberately leaves it behind. Please extract a pure parse_seed_usage_snapshot(&str) function and test it directly.

Still blocking.