Outer hardening: AppArmor profile, pids limit, egress allowlist proxy

Inner codex sandbox stays danger-full-access by choice (bwrap
path is a separate decision); this hardens everything around it:
- DockerExecutor: --security-opt plumbing (repeatable, dedups
  no-new-privileges), --pids-limit (CLI default 512, fork-bomb
  guard), per-call extra_env (-e NAME=VALUE, non-secrets only,
  e.g. proxy URLs; the model key still goes by -e NAME only).
- Worker: --egress-proxy-port (0 = off). When on, Docker task
  containers get HTTP(S)_PROXY pointing at the host filtering
  proxy via their network gateway IP (tenant network gateway
  or default bridge gateway). Gateway unresolvable => the
  attempt fails instead of running unproxied (fail closed,
  same rule as tenant network creation failure).
- AppArmor profile deploy/apparmor/docker-codex: docker-default
  base + deny network raw/packet, deny ptrace, deny mount/
  umount/pivot_root, deny dangerous capabilities, deny writes
  to /proc/sys, /sys, /proc/keys. Deliberately NO userns rule
  (that would enable the bwrap path, not this one). File rules
  mirror docker-default (broad + sensitive denies); a strict
  file allowlist would need profiling codex's file access set
  and is not claimed here.
- Egress proxy deploy/egress/: Tinyproxy with
  FilterDefaultDeny + anchored domain allowlist (relay,
  github, pypi, npm). Anchoring matters: an unanchored
  'github.com' regex would also match 'evilgithub.com'.
- Seccomp honesty (README): Docker default seccomp already
  enforces on all task containers; no new stricter allowlist
  is claimed in this change (building one from memory risks
  silently breaking the toolchain; it needs syscall profiling
  first).
Tests: 3 outer-hardening tests (security-opt dedup, pids
limit, proxy env without leaking the key value, gateway
parse/fail, proxy fail-closed). Full suites pass.

deploy/apparmor/docker-codex

@@ -0,0 +1,78 @@
+# AppArmor profile for codex task containers (outer hardening).
+#
+# Based on Docker's default container profile, with stricter denies:
+# - deny network raw: no raw sockets (ping/scan/sniff tricks)
+# - deny ptrace: no process injection / debugging other processes
+# - deny mount/umount: containers must never mount (bwrap path is
+#   NOT enabled here; inner sandbox stays danger-full-access by
+#   choice, so mount inside the container is pure attack surface)
+# - deny dangerous capabilities (defense in depth; containers also
+#   run with --cap-drop=ALL, so these are a second lock, not the
+#   only one)
+# - deny writes to /proc/sys, /sys, /proc/keys (kernel tunables)
+#
+# Deliberately NOT included: `userns` (that would enable the bwrap
+# inner-sandbox path, which is a separate decision, not this one).
+#
+# Install: cp to /etc/apparmor.d/docker-codex, then
+#   apparmor_parser -r /etc/apparmor.d/docker-codex
+# Use: docker --security-opt apparmor=docker-codex
+# (worker flag: --docker-security-opt apparmor=docker-codex)
+# Verify: docker inspect <container> shows
+#   "AppArmorProfile": "docker-codex" (not "docker-default").
+
+#include <tunables/global>
+
+profile docker-codex flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+
+  network inet tcp,
+  network inet udp,
+  network inet icmp,
+  network inet6 tcp,
+  network inet6 udp,
+  network inet6 icmp,
+  deny network raw,
+  deny network packet,
+
+  capability chown,
+  capability dac_override,
+  capability fsetid,
+  capability fowner,
+  capability mknod,
+  capability net_bind_service,
+  capability setfcap,
+  capability setgid,
+  capability setpcap,
+  capability setuid,
+  capability sys_chroot,
+  deny capability sys_admin,
+  deny capability sys_ptrace,
+  deny capability net_admin,
+  deny capability net_raw,
+  deny capability sys_module,
+  deny capability sys_rawio,
+  deny capability sys_boot,
+  deny capability sys_time,
+  deny capability mac_admin,
+  deny capability mac_override,
+
+  deny mount,
+  deny umount,
+  deny pivot_root,
+  deny ptrace,
+
+  file,
+  deny @{PROC}/sys/** w,
+  deny @{PROC}/sysrq-trigger rw,
+  deny @{PROC}/keys/** rw,
+  deny @{PROC}/kcore rw,
+  deny /sys/** w,
+  deny /etc/shadow rw,
+  deny /etc/gshadow rw,
+
+  signal,
+  unix,
+  dbus,
+  ptrace (readby),
+}