#22355 cmux-next Mac: Chief for phones, workspace-folder previews, Codex start model (cnx-ios D2, D9, D4)

Summary

Mac side of #22354 (cmux-next iOS full-verify fixes), cherry-picked onto feat-cnx-ios-macnext so the dogfood Mac build carries them:

• D2: the app hands cnx-hostd its own Chief owner (CNX_CHIEF_SESSION, and CNX_CHIEF_SOCKET once connected). A DEV or tagged build's Chief lives at ~/.cmux/chief/<bundle id>; hostd used to dial the default home's owner and refused every phone chief channel. Test: IPhoneHostChiefTests.
• D9: cnx-hostd's file service also reads the folders of the Mac daemon's tabs (the folders already shared with phones for agent chats), never /, home or its ancestors; no workspace folders without a resolvable HOME; compared in the stored spelling as acpmux does. SECURITY.md updated. Tests: services::tests.
• D4: acpmux skips a catalog start model the harness does not list (only the catalog default, only when the harness reports catalog ids), so an account without GPT-6.1 Sol starts Codex on its own default. Test: start_defaults::a_catalog_default_the_harness_does_not_offer_is_not_used.

Tests: cnx-hostd all + clippy and acpmux 521 + clippy on rbx; Mac Swift on the fleet.

Changelog

• Fixed: iPhone Chief over the link on tagged builds; iPhone file previews of chat-edited files; Codex chats no longer start on a model the account lacks.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes three phone-integration issues on the dogfood Mac build: iPhone Chief over the link on DEV/tagged builds, phone previews of chat-edited files, and Codex chats starting on an unavailable model.

Changes

• The Mac app now passes its own Chief owner (session and socket) to cnx-hostd, so phones connect on builds whose Chief lives at ~/.cmux/chief/<bundle id> instead of the default.
• cnx-hostd's file service now also reads the Mac daemon's workspace folders (the same folders shared for agent chats), never home or its ancestors, so previews work for files edited in a workspace.
• acpmux skips a catalog default start model the harness doesn't offer, falling back to the harness's own default.