Add dormant Codex protected provider candidate

[dataforxyz]

Summary

• add an exact eight-field unsigned/non-authoritative Codex protected-provider candidate
• package a deterministic standalone zero-import provider artifact
• add fail-closed provider start and protected-service ensure boundaries
• preserve ordinary Codex/Intercom runtime wiring and Boss dormancy

Security boundary

The candidate accepts only the exact Orchestrator expectation fields for codex, canonical package/path, root:root 0555, semantic version, and lowercase SHA-256. Keys, signatures, attestations, identities, credentials, generation and installation facts are rejected.

ensureCodexBossProtectedService and the packaged provider start return explicit unavailable errors before inspecting hostile input. The artifact has no imports or fs/network/process/systemd behavior. It is not a bin, main, ordinary build target, broker import, or runtime entry.

Existing ordinary bundles change only in their generated sourceSha256 banner/build-info value caused by package metadata; after normalizing that field, all four bundles and build-info are byte-identical to main. Core remains externalized.

Verification

• commit: ac4082438e3ca90255e8e11d9c18a9334d723a72
• reviewed complete patch SHA-256: 037ac5681ac1ed89a024e648d845a97529e41b27aa0c21edea22ab878d3a753b
• committed diff SHA-256: 2c711c9c796e964080f5661b8c8654793badbcec0984df70c643b8ca27b1762a
• hostile exact-patch review: APPROVED
• focused provider/package tests: 11/11
• full suite: 204/204
• typecheck/build/diff: pass
• package: 51 entries; SHA-256 e234fd2882373b12d044076d9d8625a3684a48dd5f500fdc7e5e97a53d7cf64e
• packed standalone hostile start/import: pass