[2725238326]

An existing per-user Start-menu ChatGPT.lnk is not covered by portable launch repair, which currently maintains only Codex.lnk. A legacy-named link with a stale explicit icon therefore keeps that icon even when Manager repairs the portable launchers. Also, the shared ensure_icon helper recreates the link from ShortcutSpec, dropping Shell metadata such as its description and hotkey.

This change loads the existing Shell Link and updates only its icon, preserving its target, arguments, working directory, AppUserModelID and other metadata. Portable launch repair also applies it to an existing ChatGPT.lnk only when the target matches this installation's payload or a supported root launcher. Missing links are not created; other applications, other installations and arbitrary executables inside the install root are left alone. An already-correct icon causes no write, and legacy-link errors are logged without blocking launch.

This follows up on #440, which already embedded an icon in the launcher stubs. It does not change the root-launcher design or retarget existing links. The origin of a legacy link is not assumed, and the change neither diagnoses Windows shortcut restoration nor reads or writes undocumented backup registry data.

Validation

• Added native Windows Shell Link regressions for metadata preservation, icon index repair, idempotence (bytes and modification time), nested and flat layouts, missing links/payloads, and unrelated targets. The metadata test fails against the old helper because its description is cleared, and passes after the fix.
• cargo clippy -p codex-win-engine --all-targets --locked --offline -- -D warnings passed.
• cargo test -p codex-win-engine --all-targets --locked --offline -- --skip download::tests::download_with_progress_reports_final_size passed: 149 unit tests and 6 offline contract tests; 11 existing tests ignored, 1 explicitly filtered out.
• The unfiltered suite hits an existing local failure in download::tests::download_with_progress_reports_final_size: system curl reports Protocol "file" is disabled. Reproduced the same failure on an unmodified checkout of main at 31bd3f2; download code is unchanged.
• git diff --check passed. Full workspace/frontend checks and Explorer icon-cache behavior were not tested locally.