P1 security batch: quota execution checks, cost accounting, goal/coordinator semantics, PR channel, orphan signature, control-plane and console hardening

- Docker quota watchdog + fail-closed quota checks, system tasks need real owner
- max_cost_usd actually accumulated, cancel records cost, estimated rows excluded from unpriced cap, cache_write declared non-billed
- goal-resume keeps original verify on breakpoint resume, goal retry falls back to resume, goal_max_rounds capped at 100 at create and execution
- coordinator children inherit parent model/effort, orphans marked interrupted with audit
- PR jobs on docker workers return explicit needs_local_worker instead of silent empty
- worker code signature covers 6 files and is checked before claim, fail-closed
- sub2api lazy provisioning with rotation, backup whitelist + 0600, push SSRF block, repos/workers desensitized, key/project audits and limits, console buttons/quota/status wording, coordinator/automation quota reserve

cloud/tests/test_push.py

@@ -336,6 +336,11 @@ class TestRealSenders(PushTestCase):
 
     def setUp(self):
         super().setUp()
+        # P1 SSRF 门默认挡 loopback；本地录制服务器测试显式放行，
+        # 生产默认值仍关闭（不要把本开关当成生产默认）。
+        self._old_push_allow = os.environ.get(
+            "CODEX_PUSH_ALLOW_PRIVATE_TARGETS")
+        os.environ["CODEX_PUSH_ALLOW_PRIVATE_TARGETS"] = "1"
         _RecordingHandler.requests = []
         _RecordingHandler.status = 200
         self.server = http.server.ThreadingHTTPServer(
@@ -349,6 +354,11 @@ class TestRealSenders(PushTestCase):
         self.server.shutdown()
         self.server.server_close()
         self.thread.join(timeout=5)
+        if getattr(self, "_old_push_allow", None) is None:
+            os.environ.pop("CODEX_PUSH_ALLOW_PRIVATE_TARGETS", None)
+        else:
+            os.environ["CODEX_PUSH_ALLOW_PRIVATE_TARGETS"] = (
+                self._old_push_allow)
         super().tearDown()
 
     def _url(self, path="/hook"):