P1 security batch: quota execution checks, cost accounting, goal/coordinator semantics, PR channel, orphan signature, control-plane and console hardening

- Docker quota watchdog + fail-closed quota checks, system tasks need real owner
- max_cost_usd actually accumulated, cancel records cost, estimated rows excluded from unpriced cap, cache_write declared non-billed
- goal-resume keeps original verify on breakpoint resume, goal retry falls back to resume, goal_max_rounds capped at 100 at create and execution
- coordinator children inherit parent model/effort, orphans marked interrupted with audit
- PR jobs on docker workers return explicit needs_local_worker instead of silent empty
- worker code signature covers 6 files and is checked before claim, fail-closed
- sub2api lazy provisioning with rotation, backup whitelist + 0600, push SSRF block, repos/workers desensitized, key/project audits and limits, console buttons/quota/status wording, coordinator/automation quota reserve

cloud/tests/test_prod_webhook_exec.py

@@ -41,6 +41,9 @@ class WebhookExecTestCase(unittest.TestCase):
         self.owner_id, self.owner_key = self.auth.create_user("owner")
         self._old_admins = os.environ.get("CODEX_GLOBAL_ADMINS")
         os.environ["CODEX_GLOBAL_ADMINS"] = self.owner_id
+        # P1：备份 out_dir 限白名单根；本测试的 tmp 目录即白名单根。
+        self._old_backup_root = os.environ.get("CLOUD_BACKUP_ROOT")
+        os.environ["CLOUD_BACKUP_ROOT"] = self.tmp.name
         self.viewer_id, self.viewer_key = self.auth.create_user("viewer")
         self.server = create_server(self.db_path, "127.0.0.1", 0)
         self.port = self.server.server_address[1]
@@ -67,6 +70,10 @@ class WebhookExecTestCase(unittest.TestCase):
             os.environ.pop("CODEX_GLOBAL_ADMINS", None)
         else:
             os.environ["CODEX_GLOBAL_ADMINS"] = self._old_admins
+        if getattr(self, "_old_backup_root", None) is None:
+            os.environ.pop("CLOUD_BACKUP_ROOT", None)
+        else:
+            os.environ["CLOUD_BACKUP_ROOT"] = self._old_backup_root
 
     def _req(self, method, path, body=None, key=None, headers=None,
              raw_body=None):