Harden arbiter phase confirmation, XPC request bounds, and Codex default fields

[Reedtrullz]

Repairs and rebases the retained hardening work on current main.

What changed

• Bound XPC transaction IDs, session IDs, and reasons by UTF-8 byte length.
• Preflight raw XPC fan collections before traversal and cap them at the physical ten-fan domain.
• Make Codex usage an opt-in menu-bar field for new/default preferences while preserving explicitly saved Codex selections.
• Keep the arbiter's .active phase requirement explicit as defense in depth and cover the non-active journal regression.
• Correct the changelog: these changes were not part of v1.4.5 and now appear under Unreleased.

Validation

• XPC targeted tests: 10/10 passed.
• Arbiter targeted tests: 35/35 passed.
• Preferences targeted tests: 24/24 passed.
• Directly affected menu-bar tests passed.
• A standalone checkout at exact head passed the full local make verify-full gate.

The full gate includes the fast suite, warnings-as-errors build, release-app assembly and metadata checks, and the repository's slow validation suites.

Boundaries

• This is not a signed release, tag, notarization, or hardware/manual acceptance claim.
• The arbiter phase check is intentionally described as defense in depth because an earlier guard already rejects a non-active journal.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.