Finish the public audit cleanup

[mgc26]

Summary

• replace historical Codex thread fixtures and log timing notes with synthetic data
• remove internal tracker labels and private workflow phrasing from public tests
• make the preview script discoverable and use neutral example projects
• document launch.claudeArgs and correct watch-only session expiry guidance

Why

A final review of the private publication handoff identified scrub work that had been planned but never reached the public repository. None of it was a credential, but historical identifiers, forensic timing notes, and internal review labels do not belong in a polished public codebase. The install guide also described all stale sessions as lasting 24 hours even though finished watch-only sessions expire after about 30 minutes.

Validation

• preview command generated a valid 1626×792 contact sheet
• targeted Codex resume suite: 9/9 passed
• full suite: 381/381 passed on Node 22.18 and Node 24
• TypeScript build passed on both supported Node lines
• npm audit: 0 vulnerabilities
• gitleaks: no leaks across branch history
• README and install-guide links passed validation