Run Linux drop-sudo with reduced process credentials

[winston-openai]

Summary

• launch Codex under the existing Linux runner UID and primary GID while clearing supplementary groups and process capabilities
• set no_new_privs and hold the prompt until sudo removal has completed and been verified
• preserve the runner's home, checkout ownership, Git configuration, caches, and output-file behavior
• keep promptless setup available while warning that later direct Codex commands do not pass through the action's reduced process identity
• add focused Linux coverage for both successful credential reduction and fail-closed startup

Compatibility

• macOS behavior remains unchanged
• Linux drop-sudo requires a non-root runner with passwordless sudo and /usr/bin/setpriv; GitHub-hosted Ubuntu runners provide this setup
• no system accounts, filesystem ACLs, Git safe-directory entries, or alternate home directories are introduced

Validation

• pnpm run check
• pnpm test
• both privileged Linux cases passed in a disposable Node 22 environment
• git diff --check
• public-content scan for internal references and disclosure-specific terminology

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[winston-openai]

I have read the CLA Document and I hereby sign the CLA