Harden launchers/patchers from external audit + add CI#4

phase3dev merged 2 commits into

mainphase3dev/claude-code-workarounds:mainfrom

codex-audit-fixesphase3dev/claude-code-workarounds:codex-audit-fixesCopy head branch name to clipboard