Add CDP controls to settings

[agustif]

What this does

Adds first-class Chrome DevTools Protocol controls to the Codex++ settings UI.

The new settings card shows:

• whether CDP is off, saved for next launch, or active in the current process
• the active/configured remote debugging port
• local /json/list and /json/version endpoints when CDP is active
• a copyable launch command for the detected app bundle
• a saved enable/disable toggle and editable port
• channel-aware defaults: stable falls back to 9222, beta falls back to 9223

The main process now persists CDP settings, resolves startup CDP from argv/env/config, exposes status over IPC, and only opens local CDP URLs for /json/list and /json/version.

Why this is needed

CDP is central to live debugging Codex.app when in-window DevTools are disabled, but previously it was an env/launch-arg trick with no visible state. Stable and beta are commonly run together, so the UI needs to make ports, launch commands, and restart/session state explicit.

How this was proven

Branch-local checks:

• npm run build passed in /Users/af/codex-plusplus-prs/cdp-settings.
• npx tsc -p packages/runtime/tsconfig.json --noEmit passed after SDK build.
• npm test passed in /Users/af/codex-plusplus-prs/cdp-settings: 80 tests passed.

Integrated installed-app smoke after rebuilding and repairing both apps:

• Repaired /Applications/Codex.app and /Applications/Codex (Beta).app with node packages/installer/dist/cli.js repair --force --quiet.
• Reopened stable with --remote-debugging-port=9222; http://127.0.0.1:9222/json/version returned Electron/Chrome version metadata.
• Reopened beta with --remote-debugging-port=9223; http://127.0.0.1:9223/json/version returned Electron/Chrome version metadata.
• Opened Codex++ Settings > Config over CDP and verified stable shows Developer / CDP, Active on 127.0.0.1:9222 from launch arg, endpoint http://127.0.0.1:9222/json/list, and no restart note.
• Verified beta shows Developer / CDP, Active on 127.0.0.1:9223 from launch arg, endpoint http://127.0.0.1:9223/json/list, and a secondary restart note for its saved-port mismatch.

Screenshots / Visual Proof

Local proof artifact captured during the installed-app smoke:

• /tmp/codexpp-cdp-settings-qa.png - stable Codex++ settings showing the Developer / CDP card active on 9222.

Risk / Rollout

This touches startup command-line handling and settings IPC. Existing env behavior still works via CODEXPP_REMOTE_DEBUG=1; explicit --remote-debugging-port remains authoritative. Saved settings only affect future launches because Chromium requires the switch before app ready.

[b-nnett]

thanks for the PR's! give me an hour to get back to the office and i'll review/merge them

[b-nnett]

hey, good feature idea but a few things before i can merge:

• This does not apply cleanly onto the current 0.1.5 branch. It conflicts in packages/runtime/src/main.ts, packages/ runtime/src/preload/settings-injector.ts, and generated runtime assets.

• The branch is stale against the released line: it still has CODEX_PLUSPLUS_VERSION = "0.1.3" and drops the 0.1.4 self-update config fields (updateChannel, updateRepo, updateRef) from persisted state.

• CDP source reporting looks wrong after config/env enables CDP. The startup config is resolved once, then
  getCodexCdpStatus() resolves it again after the command-line switch has been appended, so config/env can show as argv.

• Disabling CDP while the current process is active does not seem to show the restart warning, because restartRequired is only true when enabled && activePort !== configuredPort.

• The copied launch command is macOS-only (open -na). Codex++ supports Windows/Linux too, so this should either be platform-aware or clearly labelled macOS-only.