fix: restore app-server model patch on Codex 26.707+

[WAYLON]

Summary

• Codex desktop 26.623+ / 26.707+ no longer ships the standalone app-server-manager-signals-* asset.
• Model whitelist unlock and plugin marketplace request patch currently hard-load that asset, fail with 未找到 Codex App asset: app-server-manager-signals-, and never patch sendRequest.
• Keep the legacy asset lookup first, then fall back to discovering sendRequest clients from currently loaded app bundles (app-initial / app-main chunks).

Root cause

installAppServerModelRequestPatch() and installPluginMarketplaceRequestPatch() both did:

await loadCodexAppModule("app-server-manager-signals-")

On current ChatGPT/Codex app (26.707.41301 verified), that filename prefix does not exist. The client was inlined into larger bundles, so the module loader throws and the model list injection path stalls.

Changes

• assets/inject/renderer-inject.js
  • shared loadAppServerRequestCandidates() discovery helper
  • prefer legacy asset name, then scan modulepreload/resource URLs for app bundles
  • collect nested sendRequest clients from module exports
  • use that discovery for both model whitelist and plugin marketplace request patches
  • bump model request patch version so old failed installs rebind
• crates/codex-plus-core/tests/cdp_bridge.rs
  • assertions for fallback discovery helpers / version

Test plan

• cargo test -p codex-plus-core --test cdp_bridge injection_script
• cargo build -p codex-plus-launcher --release
• Install rebuilt codex-plus-plus binary and restart Codex via Codex++
• Confirm log shows model_app_server_request_patch_installed instead of ..._failed
• Confirm custom models from relay modelList / catalog appear in the model selector

Notes

Related: #1324, #1210

Verified against local Codex app:

• app: /Applications/ChatGPT.app 26.707.41301
• old asset: missing
• live fallback import found a sendRequest export on current app bundle

[BigPizzaV3]

Codex++ maintainer review note

当前 main 下这个 PR 仍存在 merge conflict，暂时不能合并。请先 rebase 到最新 main 并解决冲突；更新后我们会重新跑针对性测试再复审。

This PR currently conflicts with main, so it is not mergeable yet. Please rebase onto the latest main and resolve the conflicts, then we can review and test it again.

[WAYLON]

已 rebase 到最新 main（e2521d4）并解决冲突，分支已 force-push 更新。

冲突处理要点：

• 保留最新 main 的 use-host-config- / graceful skip / miss diagnostics；
• 合并 app bundle fallback discovery，并同时用于 model 与 plugin marketplace request client patch；
• patch version 更新为 3，补充 named asset / fallback source diagnostics 与对应测试。

验证：

• cargo test -p codex-plus-core --test cdp_bridge injection_script_discovers_app_server_request_clients_without_hardcoded_hash -- --exact ✅
• cargo test -p codex-plus-core --test cdp_bridge injection_script_unlocks_custom_model_catalog -- --exact ✅
• cargo build -p codex-plus-launcher --release ✅

补充：宽泛执行 cargo test -p codex-plus-core --test cdp_bridge injection_script 时，本 PR 相关测试通过，但最新 main 现有的 injection_script_installs_dream_skin_from_backend_settings 仍失败（upstream dream-skin asset 中仍含带 style 的 attributeFilter），与本 PR 修改无关。