[codex] Harden Mirror Codex app preflight

[YSCJRH]

Summary

• Make the app-server preflight report mcpServerStatus/list timeouts as open MCP status evidence by default instead of failing the entire install/skill preflight.
• Add strict mode via --require-mcp-status so status enumeration can still be enforced when needed.
• Include request method names and per-request timeout detail in app-server timeout errors.
• Make the Mirror Codex MCP server prefer the workspace cwd when it is launched from an installed plugin cache, so canonical demo artifacts resolve from the repo instead of the cache path.
• Update plugin docs to preserve the evidence boundary: app-server install/skill checks are not interactive UI tool-card evidence.

Validation

• python -m pytest plugins\mirror-codex\tests -q
• python plugins\mirror-codex\scripts\smoke_mcp_stdio.py
• ./make.ps1 plugin-app-preflight
• python plugins\mirror-codex\scripts\app_protocol_preflight.py --require-mcp-status --mcp-status-timeout 3 fails as expected on mcpServerStatus/list
• ./make.ps1 plugin-release-check
• python -m pytest backend\tests\test_api.py -q
• git diff --check

No frontend files changed, so npm run build --prefix frontend was not run.