codex worker adapter: worktree-aware sandbox, fresh tokens, commit fallback

[jorisjonkers-dev-agents]

Orchestrating codex workers at scale (10+ codex exec invocations across the deploy-platform program and the suppression-removal wave) hits the same four mechanical failures every time. An agent-kit codex-worker wrapper should absorb them:

1. Worktree git metadata is outside the sandbox. codex exec -s workspace-write -C <worktree> cannot commit: a git worktree's index/locks live under the main repo's .git/worktrees/…, which stays read-only. Every worker ends with uncommitted changes and the orchestrator commits blind. The wrapper should add the worktree's real git dir as a writable root (--add-dir on the resolved git rev-parse --git-dir), or provide a documented commit-fallback contract.
2. Tokens expire mid-program. App installation tokens live ~1h; the credential helper only re-mints when cwd is inside /workspace/<repo>. Workers in scratchpad worktrees inherit a stale GH_TOKEN and every push/API call 401s. The wrapper should mint a fresh per-repo token at launch and export it explicitly.
3. No network for build tooling. Gradle cannot even download its wrapper distribution under the default sandbox, so JVM workers cannot self-verify and CI becomes the compile arbiter (three consecutive lint-failure round-trips on one wave). The wrapper should support a declared verification profile per repo (allowed hosts + writable caches) or explicitly record "CI-verified only" in the worker's report contract.
4. Repo conventions must be re-briefed every time. Each prompt hand-carries the same boilerplate (suppression ban, detekt/ktlint style traps, commit-message rules, report format). A per-repo codex-brief.md generated from CLAUDE.md/AGENTS.md + lint configs would let prompts shrink to the task itself.

Together with the liveness contract from #18, this would make codex delegation roughly as hands-off as Claude subagents.