feat: authenticate sidecar startup readiness

[kev1n77]

Summary

• authenticate sidecar readiness with a dedicated 256-bit startup token
• intercept and validate a local versioned readiness probe without forwarding or capture
• reject occupied-port impostors and require startup identity verification in packaged bundles
• update security and progress documentation

Verification

• python -m unittest discover -s sidecars/mitmproxy/tests -v (22 passed)
• cargo test -p codeischeap-sidecar-runtime --all-targets (14 passed, 1 ignored interactive CA test)
• cargo clippy -p codeischeap-sidecar-runtime --all-targets -- -D warnings
• cargo fmt --all -- --check
• cargo fmt --manifest-path apps/desktop/src-tauri/Cargo.toml -- --check
• npm run sidecar:package
• npm run sidecar:verify
• git diff --check

Local environment note

Desktop Tauri test and Clippy builds are blocked locally because vendored OpenSSL cannot find Perl; CI provides the authoritative platform builds.