fix: update Codewhale installer pin and synchronize verified bootstraps

[LIghtJUNction]

Changes

• Pin the Codewhale provider to adad64b7ac77ec997b5be4662c6b6ccf36998357 (provider PR feat: 精简公共安装逻辑，新增 Codex、Claude Code、CC Switch、Clash Verge Rev #1, version 0.1.0-alpha.2).
• Reject forwarded --profile overrides while retaining native -p prompt and -c continue flags.
• Commit the helper first, then bind both Bash and PowerShell launchers to that immutable helper revision and the SHA-256 of its exact bytes. Integrity checks remain mandatory.
• Refresh installation guidance and argument/integrity regression tests.

Validation

Passed Bash syntax, Node Codewhale/OpenCode/entrypoint suites, Python menu/core/AI-tool contract suites, ShellCheck and the PowerShell Codewhale tests in the upgrade validation run. PR CI additionally exercises the cross-platform installers.

The temporary upgrade writer has been removed. No existing user config, production OAuth login, main-branch merge, publication or deployment was performed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-06T13:14:42.597051Z	879e6bc	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

Copilot review overview

🟢 Approval recommended

The focused changes have consistent integrity pins and argument validation, with supporting regression coverage and no unresolved findings.

Review effort: Balanced
Findings: None

What changed in this PR

Updates the Codewhale installer’s provider pin and keeps both standalone launchers synchronized with the verified helper.

Changes:

• Pins the provider to adad64b7ac77ec997b5be4662c6b6ccf36998357.
• Rejects forwarded --profile overrides while preserving native -p and -c flags.
• Updates launcher revision/checksum pins, regression tests, and installation guidance.

File	Description
test-codewhale.mjs	Tests profile rejection, native flags, and the updated helper revision.
codewhale.sh	Updates the immutable helper revision and required checksum.
codewhale.ps1	Applies matching helper revision and checksum pins.
codewhale.mjs	Updates the provider pin and blocks profile overrides.
CODEWHALE.md	Documents the new pin, argument restrictions, and integrity checks.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.