Pre-release hardening

Decouple names from folders (explicit paths + folder picker, visual-only groups), pin Codex conversations, fix drag-into-group, async usage, WS origin check, secrets filter

Public template: auto-locks at runtime, shows duplicate-to-private widget