Fix npm-installed Codex detection for v1.0.1

[causercode]

Summary

• detect npm-installed Codex CLI on Windows by treating codex.cmd and codex.ps1 as discovery anchors
• resolve only the expected native x64 or ARM64 executable from bounded nested and hoisted npm package paths
• preserve configured, standalone, and direct PATH executable precedence
• report npm-specific executable provenance in Settings
• target this patch for v1.0.1

Fixes #5

Verification

• Release build succeeds
• Automated tests pass
• Formatting check passes
• Package vulnerability audit passes
• Relevant manual UI and accessibility checks were completed (not applicable; no UI layout or interaction changes)

Security and privacy

Process launching is affected. npm shell shims are never executed or returned; they are used only as anchors for exact, architecture-specific native executable paths. Candidates still must be fully qualified existing .exe files. No credential, provider communication, logging, storage, or startup behavior changes.