[jsgrrchg]

NeverWrite currently embeds Codex 0.166.0. Upgrade the embedded runtime to stable 0.167.0 (086ccc833bc9cf01024ad2dd6af7dbd421b6bf9a), including every Codex dependency, the local PTY package, the committed lockfile, and packaging source checks. Both runtime executables use the same baseline.

Adapt the ACP boundary to the new approval lifecycle:

• Give network approval callbacks separate activity identities and route resolution across active and background projections. Expired requests close only their matching desktop waiter; duplicate resolutions and late replies are ignored.
• Present managed HumanCommand checkpoints with one-time approval, rejection, and cancellation options. Resolve their activity independently of the command execution.
• Add regression coverage for concurrent callbacks, answered and expired network requests, delayed permission requests, session isolation, and human checkpoint lifecycle.

Retain NeverWrite's ACP v1 contracts and existing feature restrictions. V8 152.2.0, its pinned cppgc patch, verified artifact checksums, the Rust toolchain, and upstream PTY sources remain aligned. Update maintenance documentation and use 0.166.0 as the rollback baseline.

Validation on Linux x64:

• Adapter workspace: 118 unit tests, 2 standalone-host integration tests, and 62 PTY tests passed with verified V8 artifacts.
• Native backend: 372 tests passed; the expanded permission-waiter regression also passed separately.
• Frontend/review/staging/V8: 633 tests passed. Release assets: 8 tests passed.
• TypeScript, ESLint, adapter formatting, locked all-target checking, and adapter/native-backend all-target Clippy with warnings denied passed.
• Fresh runtime smoke passed inline-image forwarding, standalone Code Mode execution, assistant completion, and missing-host failure.
• Independently built 0.166.0/0.167.0 runtime pairs passed upgrade, rollback, and re-upgrade load/resume, plus paginated history restoration and continued turns.

Runtime smokes use isolated temporary state and a local Responses mock. Local runtime execution used debug builds; native macOS/Windows execution, signing, and full release packaging are covered by the existing package CI matrix.