feat: add interactive Codex mascot creation and canvas integration

[CLOSETTTY]

Summary

Add Settings > Mascots so a user can start an interactive Codex workflow from a PNG or JPEG, review the generated character and animations in CanvasTTY's browser, and install the approved result as a transparent canvas mascot.

The workflow is bundled with the application and can also be used as a portable Codex skill. It preserves source images, character identity and the complete action plan; it measures body/prop scale and atlas placement, reviews every playback step, and keeps visual approval separate from installation consent. Mechanical checks do not claim to guarantee generative quality.

Included changes

• Creation UI: English/Russian Mascots settings, file picker and drag/drop, source preview, project/session access, failure status, retry and full installation logs. Accept PNG/JPG/JPEG with or without a background, up to 20 MB and 32–4096 pixels per dimension.
• Codex launch: one new chat with one image and the complete launch brief, explicit YOLO/bypass disclosure using the existing acknowledgement, and CanvasTTY browser access for the live workbench. Preserve normal launch behavior for other sessions/providers.
• Portable pipeline/skill: full-body preparation and optional appearance revision, suggested/custom actions and object interactions, source-to-atlas scale/contact checks, detailed face/material/hair/prop/effect continuity review, deterministic step inspection, live playback, build-specific approval and resumable project evidence.
• Successful motion examples: neutral atlas/data sets containing 152, 39 and 16 drawings, plus an unchanged-art placement regression. The bundle adds approximately 46 MB before compression. These are motion/review references, not the new character's identity or a promise of error-free generation.
• Canvas presentation: transparent parent card, drag through the mascot, interactive animation menu, proportional narrow-card resizing, hover controls with touch resize support, current-package reload on update, and continued rendering at summary zoom. Other canvas plugins retain their normal presentation.
• Verified local delivery: register only a contained static mascot package; preserve the previous installed revision; reject unknown unregistered destination directories; retry corrected requests after failure without restarting; expose requested/installed/registered state and full diagnostic logs.
• Explicit drafts: separate draft acceptance from final visual approval, preserve the full plan/deferred phases, and retain user-accepted unresolved limitations. No manual registry edits or handwritten installation handoffs.
• Windows launch prerequisite: use PowerShell syntax for Codex lifecycle/plugin/decision hooks, retaining stdin/environment/exit status and other providers' existing hook behavior.
• Documentation and checks: maintainer/user guide, host and launch regression tests, Python pipeline checks on Ubuntu/macOS, packaged Linux AppImage checks and bundled macOS resource checks.

How to try it

1. Run the application from this branch using the repository's normal development/build setup.
2. Install/authenticate Codex CLI and provide a Python 3.10+ environment with Pillow and NumPy. Set CANVASTTY_MASCOT_PYTHON if using a virtual environment. The Codex session needs image-generation/editing tools and the CanvasTTY agent browser connector.
3. Open Settings > Mascots > Create mascot and upload a PNG or JPEG. The dialog explains the bypass launch before starting it.
4. Approve the prepared character, choose an example/custom action, and inspect source frames, deterministic atlas steps and playback in the local browser workbench.
5. Approve the identified final result, or explicitly accept a disclosed draft, then approve installation. Check the resulting transparent card's menu, drag, proportional resize, close and summary zoom.
6. For rejected handoffs, inspect Open full log and use Retry installation after correction; no application restart or manual plugin copy is needed.

See the mascot guide and the complete pipeline/skill for the contracts. The committed bundle excludes user profiles, conversation exports, generated test projects, private paths, credentials, logs and development executables.

Linux and macOS integration

The PR ships portable source/resources, not the Windows preview executable. Filesystem paths and process spawning use the host's platform APIs; Python and the existing Codex launch path support Linux and macOS. Shared Electron packaging includes the pipeline on each platform. Existing Linux isolation/provider protections are preserved.

• Ubuntu checks cover application regressions, installer builds, embedded mascot resources, packaged AppImage startup, terminal rendering and browser behavior.
• macOS checks build the existing Apple Silicon application, verify embedded mascot resources, then check packaged CLI resolution, terminal rendering and browser input.
• Python intake/build/delivery and real-art placement checks run on both Ubuntu and macOS.

The guide includes a distribution-independent Python virtual-environment setup. On macOS the same Python 3.10+ environment with Pillow and NumPy is required. If a packaged app does not inherit the terminal's Python environment, launch its executable explicitly with the interpreter selected:

CANVASTTY_MASCOT_PYTHON="/absolute/path/to/venv/bin/python" \
  "/Applications/CanvasTTY.app/Contents/MacOS/CanvasTTY"

Adjust the application location to its actual installation. Image generation requires the user's authenticated Codex and available generation/browser tools on every platform. A live mascot-generation session on the user's exact OS remains a separate acceptance check.

Validation and release limits

Local Windows validation:

• npm test: 1,716 passed, 135 skipped, 0 failed (1,851 tests).
• npm run typecheck: passed.
• npx electron-vite build: production main/preload/renderer bundles passed.
• npm run audit:secrets: repository source and built bundle passed.
• Python pipeline smoke test and real-art placement regression: passed.
• CI workflow YAML parsing and staged whitespace validation: passed.

The local broad Windows test run used an existing staged named-pipe helper whose native source is unchanged from upstream; Visual Studio C++ tools are absent on this workstation. The remote Windows CI subsequently rebuilt and self-tested that helper, ran the Windows tests/type-check, and successfully built the Windows installers.

Remote verification of the exact PR head, 7179de15209698f542241c20064fbffece13704a:

• CI run #3 in the contributor fork: all five jobs passed.
• Ubuntu verify: application tests, companion tests, type-check, production bundles, Linux AppImage/deb builds, embedded mascot resources, packaged AppImage startup, terminal and browser/helper smoke checks.
• Windows windows-pipe-host: native helper build/self-test, application tests, type-check and installer packaging.
• macOS macos-cli-resolution: Apple Silicon app packaging, embedded mascot workflow/player, packaged CLI resolution, terminal rendering and browser input.
• mascot-pipeline on Ubuntu and macOS: Python smoke contracts and real-art placement regression.

The upstream pull-request workflow may still require a maintainer's approval for the first contribution from this fork. The linked fork run verifies the same head without changing upstream approval policy. Approve and rerun upstream CI before merging according to the repository's policy.

This PR is ready for code review and integration consideration; it does not publish a release. The rebased branch has not been exercised as a complete live mascot-creation session on all three platforms. Live generation and mascot-card interaction should be reviewed before release. Image generation remains interactive and can require repairs; synthetic QA and reference assets do not establish artistic quality.