[codex] Fix Browser plugin file URL policy

[ilysenko]

Summary

• Patch the staged Browser plugin URL policy so local file:// targets are allowed on Linux.
• Keep the policy narrow: data:, javascript:, ftp:, invalid URLs, and remote file://host/... URLs stay blocked.
• Update Browser plugin staging smoke fixtures to match the current upstream try { new URL(...) } catch { return false } helper shape.

Fixes #268.

Root cause

The bundled Browser plugin advertises local file:// support, and the downstream approval flow already knows how to request approval for file: origins. The earlier URL policy gate rejected file: before that approval path could run.

Validation

• bash -n scripts/lib/bundled-plugins.sh tests/scripts_smoke.sh
• git diff --check
• tests/scripts_smoke.sh
• make build-app-fresh against freshly downloaded upstream DMG 26.519.41501 / Electron 42.1.0 / SHA256 3101c05dfd40314115418c4ad87edee02419d097f7164c677ddbdd4559ad8a42
• Verified the staged Browser client contains codexLinuxFileUrlPolicy in the real upstream helper and no URL-policy insertion warning is emitted