fix(config): align Devin updates and Codex MCP policy

[verlyn13]

Summary

• rename current user-facing Windsurf surfaces to Devin Desktop while retaining only the compatibility identifiers still required by installed paths and Homebrew receipts
• add generic stale Homebrew cask receipt/app-bundle detection so one renamed or externally moved app is skipped with repair guidance instead of blocking unrelated cask upgrades
• align Codex MCP approval configuration with the official Codex CLI schema, including Firecrawl write approval policy, Cloudflare prompt policy, and intentional reconciliation of app-written per-tool overrides
• extend readiness checks, regression coverage, and ownership/framework documentation for both config lanes

Why

The installed devin-desktop cask still carried a legacy receipt pointing at /Applications/Windsurf.app, while the current application identity is Devin. Homebrew therefore failed that cask after downloading it, even though unrelated upgrades could continue.

Separately, Codex had written valid per-tool approval tables inside the managed MCP server subtree. The canonical registry did not represent those tables, so fail-closed sync correctly reported drift but could not reproduce the intended effective policy.

Impact

• current docs and operator output use Devin Desktop terminology
• legacy Windsurf strings remain only where they are operationally required for compatibility
• stale cask receipts are reported and skipped without weakening failure handling for genuine Homebrew errors
• Firecrawl defaults to approval for write-class tools, while Cloudflare remains prompt-gated
• managed Codex MCP subtrees converge deterministically and stale app-written tool overrides are swept
• no secret material is persisted, and the Devin application bundle itself is not automatically repaired or replaced

Validation

• scripts/validate-repo.sh — PASS
  • system-update: 126 passed, 0 failed
  • Codex MCP: 47 passed, 0 failed
  • Claude Desktop MCP: 25 passed, 0 failed
• scripts/codex-mcp-readiness.sh — PASS; 1Password Dev vault reachable
• scripts/sync-mcp.sh --dry-run — PASS for all targets; no files written
• chezmoi apply --dry-run — PASS
• git diff --check — PASS
• live Codex TOML parsed successfully and codex mcp get reported Firecrawl=writes, Cloudflare=prompt