feat: harden ReachLynk Linux sink release

[chrisl10]

Outcome

Adds the reviewed, hermetic Linux release path and hardens AgentCookie pairing, sink startup, replay storage, and live-CDP handling for the ReachLynk Codex VPS deployment.

Release controls

• two reproducible container builds from an exact Go toolchain and image digest
• checksums, SBOM, provenance, and GitHub artifact attestations
• immutable release and exact merged-main tag enforcement
• environment-gated publication for v1.1.0-codex.1
• no pairing code in argv, logs, result JSON, or persistent files
• Tailnet-only pairing and loopback-only live CDP

Verification

• full Go test suite passes
• strict patch application and byte-for-byte product-tree comparison pass
• Security cycle 6: PASS, zero Critical/High/Medium findings
• Quality cycle 2: PASS, zero findings

Scope boundary

Generic agent-browser remains globally available. ReachLynk authenticated browser state remains project-gated and is not shared with unrelated VPS projects.