[codex] Integrate BGF hardening and smoke proof

[debuggerone]

Summary

• integrates BGF-01 browser regression fixture and Chrome GPU-service failure contract
• integrates deploy secret/certbot hardening so Certbot outages cannot leave production without runtime secrets
• integrates BGF-05 compositor warmup safety proof and source-visible segmentation-unavailable behavior
• integrates BGF-06 safe runtime diagnostics for backend init, unavailable transition, modal choice, and matte rejection
• integrates BGF-07 production smoke/prod-debug proof support for KingRT domains, background assets, and Whiteboard CSP
• checks completed BGF-01, BGF-05, and BGF-06 boxes in SPRINT.md; BGF-07 remains open for real browser call smoke

Merged worker branches

• codex/bgf-01-browser-regression-fixture (9a6affd8)
• codex/deploy-secret-certbot-hardening (0d33054a)
• codex/bgf-05-compositor-warmup-safety (bd824b7e)
• codex/bgf-06-background-diagnostics (d29b041f)
• codex/bgf-07-production-smoke-proof (86dcead9)

Validation on integrated branch

• bash -n demo/video-chat/scripts/deploy.sh
• bash -n demo/video-chat/scripts/check-deploy-idempotency.sh
• node demo/video-chat/frontend-vue/tests/contract/deploy-secret-certbot-hardening-contract.mjs
• node tests/contract/background-compositor-warmup-safety-contract.mjs
• npm run test:contract:background-filter
• npm run test:contract:background-aspect
• node tests/contract/background-regression-matrix-contract.mjs
• node tests/contract/background-runtime-diagnostics-contract.mjs
• node tests/contract/client-diagnostics-contract.mjs
• demo/video-chat/scripts/check-deploy-idempotency.sh
• bash -n demo/video-chat/scripts/prod-debug.sh
• bash -n demo/video-chat/scripts/deploy-smoke.sh
• node tests/contract/prod-debug-observability-contract.mjs
• VIDEOCHAT_PROD_DEBUG_DRY_RUN=1 VIDEOCHAT_PROD_DEBUG_SKIP_REMOTE=1 demo/video-chat/scripts/prod-debug.sh
• VIDEOCHAT_DEPLOY_DOMAIN=kingrt.com VIDEOCHAT_DEPLOY_SMOKE_SKIP_REMOTE=1 VIDEOCHAT_DEPLOY_SMOKE_SKIP_ADMIN=1 demo/video-chat/scripts/deploy-smoke.sh
• npm ci && npm run build
• git diff --check

Notes

Only codex/bgf-sprint-integration remains online as the current Codex branch; superseded online donor branches were deleted after integration.

[debuggerone]

Renamed to non-codex branch policy. Superseded by #222.