feat: redesign multi-agent setup and harden Codex V2

[regenrek]

Why:

• Make the generator accurately represent host-managed orchestration and editable child roles.
• Align the Codex 0.145 V2 catalog, evidence, and release boundaries with verified runtime behavior.
• Harden published-package and secret-scanning ownership.

How:

• Redesign the role hierarchy, provider onboarding, reset flow, model/effort controls, and responsive UI.
• Keep Luna experimental for Codex V2, expose Max accurately, and distinguish Max from Ultra delegation.
• Move historical certification and migration records under retained evidence and enforce package inventories.
• Regenerate the canonical catalog, bundles, fixtures, and live UI evidence.

Verification:

• cargo test
• pnpm site:check
• cargo run --quiet -p xtask -- release verify --inventory-only
• pnpm security:check
• React Doctor: 100/100
• Local npm tests pass; native provenance remains owned by the release-candidate workflow.