Prepare Codex and WorkBuddy runtime candidates with acceptance gates

[gofenix]

Prepare Codex 0.3.0 and WorkBuddy 0.4.0 development candidates from the shared runtime, update installation/control Skills, and make WorkBuddy CI/release builds consume isolated exported source. An active WorkBuddy broker still blocks upgrades; host live configuration does not imply hot replacement of a running executor.

Validation on macOS arm64 / Node 22.23.2:

• Codex: 91 tests plus 2 build-boundary tests; WorkBuddy: 148 plus 2.
• Both builds, validators and packages passed; isolated-source builds, browser H.264 checks, WorkBuddy native cleanup and packed-install smoke passed.
• Actual emulator viewer attempts failed with display_timeout; no phone control action ran. A read-only diagnostic received H.264 packets, but browser visible-first-frame acceptance remains unresolved.

This draft is stage 4 of 4. No release was published. Stable readiness flags remain false; actual Codex/WorkBuddy UI, Hook continuation, Unicode, two physical devices and real video soak still require acceptance. See docs/plans/2026-09-18-runtime-convergence-acceptance.zh-CN.md for evidence boundaries.