[codex] Add surface gallery example

[nahiyankhan]

Summary

• Add examples/surface-gallery as the first-run OSS demo with six curated live presets.
• Keep apps/demo as the maintainer workbench while documenting the gallery/workbench split.
• Wire the gallery into workspace scripts, build/test flows, CI, and public API/package checks.

Details

The gallery demonstrates static briefs, host-owned data resources, host actions, approval-gated flows, trusted component islands, and worker-backed analysis through focused presets instead of workbench controls. It uses the public Summon package surface only and reuses the existing apps/server /api/generate protocol.

The gallery request body sends explicit prompt, mode, surfacePlan, surfaceCeiling, scriptPolicy, narrowed capabilities, and narrowed components where needed. The host spawns the sandbox with preset-owned grants rather than trusting artifact-declared permissions.

Validation

• pnpm typecheck
• pnpm test
• pnpm build
• pnpm check:public-packages
• pnpm check:public-api
• pnpm test:gallery
• SUMMON_SAFETY_PORT=5175 pnpm test:safety
• pnpm pack:dry-run