feat: detect Codex update rewrites and add self-healing autostart

[StarsailsClover]

Problem

After the Codex 0.147 update, KeepMyConfig stopped protecting the configuration and more settings were lost. Two root causes were verified on the affected machine:

1. No persistent watch. watch had been started manually at 01:00; the Codex update/reboot left no process running, and neither the Startup folder nor Task Scheduler contained a KeepMyConfig entry. The update rewrote config.toml at 03:09 with nobody watching.
2. Detection blind spot. The update preserved model/model_provider, so changed_managed was empty. The diff scored 3 against the balanced threshold of 4 (12 protected paths removed, one new app-owned key added), so it looked like a user edit and would have been captured instead of repaired.

Fix

• A changed BROWSER_USE_CODEX_APP_VERSION plus any protected removal now forces a clobber classification; an app update with no losses remains an edit.
• Removing three or more complete mcp_servers / plugins / marketplaces / projects entries adds clobber weight.
• New autostart install|status|uninstall (Windows): a logon daemon task plus a periodic one-shot repair task (5 min default) using wrapper scripts and schtasks; doctor reports the state.

Verified

• Real incident replay with the actual damaged backup: status reports Clobber (score 6) with evidence of 7 complete table entries removed and the app version change from 26.930.31428 to 26.930.31730; watch --once restores all 12 paths and keeps the new app build.
• 33 tests passing (18 core unit + 11 workflow + 3 CLI + 1 autostart), clippy -D warnings and fmt --check clean.
• Immediate recovery already applied on the affected machine (repair fix: keep app-owned notify out of the protected overlay #3, pre-repair backup kept; status healthy).