[codex] protocol discovery and verifiable execution milestone

[workingclassbuddha]

Summary

• Add .well-known manifest discovery and URL ingestion for publisher onboarding.
• Enforce manifest trust checks, generic capability-graph planning, replay-safe execution, and portable receipt-chain verification.
• Add a minimal CLI plus protocol, publisher, and agent-builder docs with a hosted SoundMart actions.json example.

Test Plan

• pnpm test
• pnpm typecheck
• pnpm cli validate examples/soundmart/actions.json
• Dev-server smoke: validate, ingest-url, and plan against http://127.0.0.1:4173

Notes

• This stays intentionally in-memory and mocked for execution. It advances the protocol surface without adding persistence, OAuth, real provider calls, or federation.