Fixes from launch feedback and model-catalog investigation.

• Refresh expired model catalogs when the picker opens while keeping cached rows usable during discovery.
• Advertise the verified Codex 0.167.0 protocol baseline, which exposes current account models. Read-only discovery through the built harness confirmed gpt-6.1-sol and gpt-6.1-terra under ChatGPT Codex; no inference calls were required.
• Pick up newer CLI login credentials for discovery and newly created runtimes without changing explicit credentials or existing chat account bindings. Show actionable reconnect guidance for rejected sign-ins.
• Make process-monitor readiness and wait polling respond to cancellation while retaining truthful process status. Reliable hard termination of arbitrary abort-ignoring work remains tracked in #229.
• Correct the public npm package name, installer PATH persistence, and explicit scope-plugin activation in local and Docker quickstarts (#263–#265).
• Correct evaluation documentation to use retained receipts and distinguish clean-control false-positive rates from finding-level precision. No general real-codebase false-positive rate or new CVE count is established by this release.

Full PR CI, security review, focused browser/runtime regressions, docs builds, and all four native release smoke checks passed. Provider-backed qualification remains tracked in #54 and #120.

Upgrade and restart existing engines to load the backend/authentication fixes. Model availability remains account-specific; existing model selections are not changed automatically.

See PR #266 and the changelog.