Hotfix: stale-container cleanup must not delete infra containers

Worker startup cleanup previously deleted every container whose
name started with codex-, including the codex-postgres database
container. On the external host the first worker restart after
the prod-grade deploy deleted codex-postgres, leaving the
control plane unable to connect to Postgres (connection refused
on 127.0.0.1:5432, server auto-restart loop).
Fix: cleanup only deletes codex-<32-hex task id> containers,
which is exactly the name DockerExecutor gives task containers;
infrastructure names like codex-postgres never match and are
never deleted. Regression test covers postgres + non-hex names.

cloud/sandbox.py

@@ -425,14 +425,25 @@ class DockerExecutor(Executor):
                 names.append(name)
         return names
 
+    # 任务容器名是 codex-<32 位 hex 任务 id>（见 _container_name）。
+    # 启动清理只能删这种容器，绝不能按 "codex-" 前缀全删：基础设施
+    # 容器也叫 codex-*（例如 codex-postgres），按前缀删会把数据库
+    # 容器当成残留任务容器杀掉（2026-10-26 实测：worker 重启时
+    # codex-postgres 就是这样被删掉，导致控制面连不上 Postgres）。
+    _TASK_CONTAINER_RE = re.compile(r"^codex-[0-9a-f]{32}$")
+
     def cleanup_stale_containers(self, prefix="codex-"):
-        """清理上一轮残留的 codex- 容器：列出并逐个 kill+rm。
+        """清理上一轮残留的任务容器：只删 codex-<32 位 hex 任务 id>。
 
         返回已清理的容器名列表；单个容器清理失败只跳过它（kill
         本身尽力而为），列出失败时返回 []，绝不抛异常。
+        基础设施容器（如 codex-postgres）名字不匹配任务 id 正则，
+        永远不会被这里删掉。
         """
         cleaned = []
         for name in self.list_containers(prefix=prefix):
+            if not self._TASK_CONTAINER_RE.match(name):
+                continue
             try:
                 if self.kill_container(name):
                     cleaned.append(name)