Run Linux drop-sudo under a dedicated identity

[winston-openai]

Why

Linux drop-sudo now uses a dedicated per-invocation identity so process and filesystem isolation are consistent across supported runners. Codex starts under that identity only after the original job user's sudo authorization has been removed.

What changed

• create a unique locked system account for the protected Codex invocation
• grant narrowly scoped ACL access to the checkout, Codex home, schema, and held output file
• start Codex only after runner sudo authorization has been revoked and verified
• clear supplementary groups and capabilities, enable no_new_privs, and scrub workflow command-file variables
• preserve nested Git repository support
• add Linux integration coverage for identity isolation, ACL edge cases, startup gating, environment scrubbing, and output handling

Impact and compatibility

• On Linux, drop-sudo now requires prompt or prompt-file; setup-only use followed by a separate codex invocation cannot preserve the dedicated identity.
• One protected invocation is supported per fresh job because the first invocation permanently removes the job user's sudo authorization.
• Linux container jobs whose default user is root are rejected.
• The implementation targets GitHub-hosted Ubuntu and Ubuntu-compatible disposable runners with the documented fixed tool paths and ACL support. Other self-hosted environments should use a preprovisioned unprivileged-user.
• This should ship on a major-version boundary rather than moving an existing major tag without migration notice.

Validation

• pnpm run check
• pnpm test
• Linux container integration coverage for the dedicated execution identity and ACL handoff
• codex sandbox -- /bin/true smoke test under the dedicated identity
• workflow YAML parsing and actionlint
• git diff --check

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[winston-openai]

Superseded by #122.