fix(macos): preserve app icons during entrypoint repair

[shaoxianbilly]

Summary

• make repaired macOS app bundles reference the packaged .icns icon
• copy the .icns from the current app bundle instead of looking for a missing PNG sidecar
• verify in CI that every CFBundleIconFile actually exists
• add regression assertions for repaired bundle metadata

Root cause

The release DMG is packaged correctly with codex-plus-plus.icns, but the in-app entrypoint repair path rewrites Info.plist to codex-plus-plus.png and looks for a PNG beside the executable. That file is absent in the DMG apps, so Finder/Spotlight display a generic icon after repair.

Verification

• cargo fmt --all -- --check
• targeted regression test passes: cargo test -p codex-plus-core --test installers macos_bundle_metadata_contains_silent_and_manager_apps -- --exact
• workflow YAML parses successfully
• git diff --check passes

Existing unrelated test failures

The full installers test binary currently has two pre-existing macOS companion-path assertion failures involving CodexPlusPlusManager vs codex-plus-plus-manager; this PR does not touch that path logic.