Fix settings injector slash menu leakage

[b-nnett]

Summary

• prevent the settings injector from treating slash/home command lists as the settings sidebar
• guard Codex++ nav/page group syncing against invalid sidebar roots
• bump Codex++ packages/runtime to 0.1.6 and rebuild bundled runtime assets

Verification

• npm run build --workspace @codex-plusplus/runtime
• npm run copy-assets --workspace codex-plusplus
• node --check packages/installer/assets/runtime/preload.js
• node --check packages/installer/assets/runtime/preload/settings-injector.js
• node --check packages/installer/assets/runtime/main.js
• CDP checked typing /g: zero misplaced data-codexpp settings groups and no Tweak Store/settings text in slash menu body

Note: local dirty installer startup-performance files were left out of this PR.