[codex] finish sensitive mode desktop stage

[Declade]

Summary

• Defines the current desktop-app stage as API-mode protection first: Claude Code and Cursor API mode are active protect_now rows, while desktop/browser surfaces are visible as non-toggleable Coming Soon rows.
• Adds capability fields across the Go control plane, Rust onboarding registry, and TypeScript UI types so protection counts and routing proposals cannot include unsupported surfaces.
• Adds the Codex Run action and script/build_and_run.sh to build the lucairnd sidecar, bundle the Tauri app, launch it, and verify the running process.
• Adds AI-harness validation for the popover and redacted sensitive-canary checks.

Why

The previous approach mixed supported API-mode paths with desktop/browser paths that are not production-ready. This made the app look broader than what it could prove. This PR makes the useful slice reliable and honest while keeping the full interception promise visible as roadmap.

Validation

• cd lucairnd && go test ./...
• cd ui/src-tauri && cargo test
• cd ui && pnpm typecheck && pnpm test && pnpm validate:ai
• cd ui && pnpm lint
• bash -n script/build_and_run.sh
• ./script/build_and_run.sh --verify

The --verify path built the .app and .dmg, launched the app bundle, and verified the lucairn-sensitive-mode process.