Integrate reviewed DEV stack (#51, #54, #55, #56, #58)

[howdeploy]

Included changes

• Carry the reviewed integration from Integrate all open PRs (#32, #34, #35–#37, #41, #46, #50) with conflict resolution and post-merge fixes #51 by @kootik. Its active source work includes feat: add native Codex orchestration CLI and skill #32 by @teo-nex and feat(app): deny default permissions, recover the renderer, gate hidden output, notify and self-update #35, feat(workspace): terminal search, canvas navigation and the browser inspect handoff #36, and feat(attention): a session attention queue and real selection gestures #37 by @qSHEMq.
• Include fix(even-g2): isolate transport keys per paired device #54, fix(even-g2): require explicit grant for answer capture #55, fix(even-g2): align local-network Settings card layout #56, and fix(settings): keep rejected writes out of live settings #58 by @teo-nex with their original commits preserved. The fix(even-g2): require explicit grant for answer capture #55 conflict resolution keeps the Integrate all open PRs (#32, #34, #35–#37, #41, #46, #50) with conflict resolution and post-merge fixes #51 orchestrator result separate from Even G2 answer capture, which requires an explicit grant.
• Apply the DEV review fixes: room for translated Updates text; Even G2 card insets and Settings scroll position; clearer CLI recheck placement and copy; attention panel controls under Appearance; provider marks in Agents; centered radial launcher hint.

Contributor attribution

• @kootik — Integrate all open PRs (#32, #34, #35–#37, #41, #46, #50) with conflict resolution and post-merge fixes #51 integration and conflict resolution. The final non-merge fix commit includes a Co-authored-by trailer because the integration commits in Integrate all open PRs (#32, #34, #35–#37, #41, #46, #50) with conflict resolution and post-merge fixes #51 use a local Git identity that GitHub does not link to this account.
• @qSHEMq — original feat(app): deny default permissions, recover the renderer, gate hidden output, notify and self-update #35–feat(attention): a session attention queue and real selection gestures #37 commits retained in this branch.
• @teo-nex — original feat: add native Codex orchestration CLI and skill #32 and fix(even-g2): isolate transport keys per paired device #54–fix(even-g2): align local-network Settings card layout #56/fix(settings): keep rejected writes out of live settings #58 commits retained in this branch.

Merge with a merge commit, not squash, so the original authored commits reach main and keep their GitHub attribution. The independent browser-card design from #34 and the reverted #41/#46 changes are excluded from the resulting product behavior. #50 and #52 are already in main.

Verification

• The integrated DEV branch was launched in Electron and reviewed by the maintainer, who supplied UI feedback and approved preparing this PR.
• git diff --check passed. Full automated tests, typecheck, production build, and visual inspection were left for the maintainer as requested in the project instructions.