feat(lite): switch the archive to zip -9 and download the WebView2 installer on demand

[nieyuanhong]

Background

Follow-up improvements to the No-Node Lite distribution:

1. Archive format changed from tar.xz to zip (-9 max compression): tar.xz is unfamiliar to many Windows users, and zip is more universal. The same content packs to ~8.9 MB as zip -9 (vs ~6.8 MB as xz) — an acceptable size increase. codex-proxy.sh is stored with the 0755 permission bit so it stays executable after extraction on Linux/macOS; entries are written in a deterministic order, making the archive reproducible. Packaging now requires Python 3 (zipfile, preinstalled on all runners).
2. The Evergreen Bootstrapper is no longer bundled (~2 MB saved): on Windows, when --mode=webview2 is requested explicitly and the WebView2 Runtime is missing, the launcher asks first (15-second timeout). After confirmation it downloads the Bootstrapper from Microsoft's official endpoint (go.microsoft.com/fwlink/?linkid=2124703), verifies the MZ header and size, verifies the Authenticode signature (must be signed by Microsoft — the same standard as the release CI's Get-AuthenticodeSignature check), and runs it with /silent /install, polling until the runtime becomes ready. The downloaded installer is cached in the system temp directory and reused. If the download or the signature check fails, the official installation page is opened instead. auto mode behavior is unchanged (still falls back to the browser directly). Fully offline environments can point to a local installer via CODEX_PROXY_WEBVIEW2_BOOTSTRAPPER.

Changes

• scripts/portable/build-portable.mjs: zip -9 packaging; removed the --webview2-bootstrapper option and the manifest bootstrapper field (replaced with runtimeInstall: "download-on-demand")
• scripts/portable/server.mjs: on-demand installer download + Authenticode verification + temp-directory cache
• Removed scripts/portable/download-webview2-bootstrapper.mjs and the download:webview2-bootstrapper npm script; CI no longer downloads, verifies, or packages the installer
• scripts/portable/test-portable.mjs, tests/unit/portable/portable-contract.test.ts: zip metadata extraction, codex-proxy.sh permission assertions, and an assertion that the installer is never bundled
• .github/workflows/lite-ci.yml, release.yml: artifact globs changed to *.zip
• README.md plus the EN/TW/HK/JA versions, scripts/portable/README.md, and CHANGELOG.md ([Unreleased] Added/Changed/Removed) updated accordingly

Testing

• Full-platform Lite CI green on the fork (native matrix + packaging + runtime smoke on three platforms + musl smoke): https://github.com/nieyuanhong/codex-proxy/actions/runs/33995006144
• Local npm run test:lite passed (launcher smoke, no-Node guidance, HTTP probe, default data directory); npm test and npm run typecheck:scripts passed
• On-demand download path verified: ~1.78 MB downloaded from the official endpoint with the MZ check passing; Authenticode verification tested with positive and negative cases (a Microsoft-signed binary passes, an unsigned file is rejected)
• zip artifact verified: no MicrosoftEdgeWebView2Setup.exe inside, codex-proxy.sh mode 0755