[codex] Harden Mirror Codex UI acceptance workflow

[YSCJRH]

Summary

• Split Mirror Codex plugin acceptance into three evidence layers: MCP contract, app-server protocol, and clean interactive Codex UI evidence.
• Add a tracked UI acceptance template with fixed fields for exact prompt, assistant output, observable tool card/trace, tool action, args, refusal status, leak check, verdict, and notes.
• Add a local helper that writes a blank ignored acceptance record under artifacts/manual/ without calling Codex, model providers, or MCP tools.
• Update the runbook/README and PR scope allowlist so future UI acceptance records do not confuse app-server checks with true UI tool-card evidence.

Validation

• python plugins\mirror-codex\scripts\write_ui_acceptance_template.py --output $env:TEMP\mirror-codex-ui-template-test.md --date 2026-04-29 --force
• python plugins\mirror-codex\scripts\validate_plugin.py
• python -m py_compile plugins\mirror-codex\scripts\write_ui_acceptance_template.py
• ./make.ps1 plugin-app-preflight
• ./make.ps1 plugin-release-check
• git diff --check

No frontend files changed, so npm run build --prefix frontend was not run.