feat(proof): seed provider usage snapshot for proof runs

[Finesssee]

Summary

Adds the CODEXBAR_SEED_USAGE_JSON proof-harness helper so CUA proof captures can drive deterministic tray/menu states without a live Codex account:

• proof_harness.rs: seed DTO mirroring the bridge ProviderUsageSnapshot JSON shape (camelCase), validation (codex-only, warn-and-skip on malformed files — proof runs never crash on the seed), and mapping into the bridge structs. Unit test covers a full seeded snapshot incl. extra rate windows.
• main.rs: seeds the snapshot into the provider cache before the event loop / first WebView read; the cache timestamp counts as fresh so the first refresh-if-stale call does not evict it.
• commands/providers.rs: while a seed is configured, the provider cache is pinned against automatic refresh eviction for the whole run (forced/manual refresh still overwrites).
• AGENTS.md / docs/WINDOWS_PROOF.md: document the variable next to CODEXBAR_PROOF_MODE.

Commands run

• cargo fmt --all
• cargo clippy both manifests --all-targets -- -D warnings
• cargo test --manifest-path rust/Cargo.toml --lib — 1227 passed
• cargo test --manifest-path apps/desktop-tauri/src-tauri/Cargo.toml — 343 passed (incl. new seed test)
• pnpm --dir apps/desktop-tauri test — 257 passed
• pnpm --dir apps/desktop-tauri run build — ok

Testing evidence / notes

• No user-facing behavior change: the seed only activates under the new env var during proof runs, so no CUA desktop proof is attached (dev tooling only; covered by the new unit test).
• Known pre-existing environment flake (not from this PR): the codexbar lib test binary intermittently dies with STATUS_ACCESS_VIOLATION at providers::sub2api::tests::usage_request_includes_days_and_timezone. Verified reproducible on clean origin/main (526ad1b) and passing in isolation / in module-group runs; treat a one-off crash there as a rerun.

Context

Salvaged from an interrupted local session whose checkout was 67 commits behind origin/main. The redundant parts of that session (Codex identity scoping, Claude limits[]-session preference) were discarded — already landed as #276 and #334. This seed feature was the only unique remaining piece; it unblocks deterministic CUA proof for the upcoming upstream 0.49.x–0.50.1 port waves.