feat(codex-runner): gVisor variant of the image (option B of #2921)

[chronoai-kaihuei]

What

Implements #2922 — the containers/codex-runner image + contract for the gVisor model (option B of #2921). Scoped to containers/codex-runner only.

Why draft

Gated on the #2921 A/B decision. Options A (runc + Landlock + Credential Vault) and B (gVisor + direct short-lived token) are mutually exclusive. This PR is the concrete "if B" change, opened as a draft to make the diff reviewable alongside the proposal. Do not merge while option A is the chosen design — the current image is already correct for runc.

Changes

• Dockerfile — remove bubblewrap (Codex runs no inner sandbox; gVisor is the boundary); remove SSL_CERT_FILE (no Credential-Proxy MITM under gVisor); remove /opt/aevatar-sandbox-probe (Landlock-preflight only).
• smoke.sh — assert SSL_CERT_FILE unset and bwrap absent; replace the legacy-Landlock write/deny probe with a check that Codex starts with the inner sandbox disabled (danger-full-access) and does not fall back to a runc-only backend.
• README — swap the runc + Landlock + Credential-Vault runtime contract for the gVisor contract (gvisor RuntimeClass, direct token injection, egress scoped by platform NetworkPolicy).
• version.env — RUNNER_VERSION → 0.144.5-gvisor.

Demonstrated feasible

Built from this branch and run on a live gVisor node (kernel 4.4.0 Sentry):

• Codex starts as sandbox: danger-full-access — no LandlockRestrict, no bwrap error (both inner-sandbox backends are unavailable under gVisor, as expected).
• Reaches the NyxID gateway with the plain system CA bundle (no MITM) — HTTP 401 on a dummy token, i.e. connection + TLS succeed and only a real token is missing.

So codex_exec runs under gVisor with the inner sandbox disabled and a directly-injected token, with no Credential Vault and no egress sidecar.

Out of scope

• The credential-model change in the Aevatar application + the chrono-sandbox endpoint (separate work; the runner image alone does not complete option B).
• Operations runtime/tenant wiring.

Related: #2921, #2922.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.45%. Comparing base (733a93c) to head (9a3e0ac).
⚠️ Report is 8 commits behind head on dev.

@@           Coverage Diff           @@
##              dev    #2924   +/-   ##
=======================================
  Coverage   83.45%   83.45%           
=======================================
  Files        1376     1376           
  Lines      112732   112732           
  Branches    14366    14366           
=======================================
+ Hits        94083    94084    +1     
  Misses      12096    12096           
+ Partials     6553     6552    -1     

Flag	Coverage Δ
ci	83.45% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.