Fix codex-host profile: capability allow + netlink (bwrap needs both)

Two bwrap failures found by live host tasks, both in the
AppArmor profile (not in codex or the worker):
1. deny capability sys_admin (etc.) breaks bwrap at userns
   creation: codex-host with the deny list failed, the same
   profile with capability, allowed it. codexsvc holds no host
   capabilities, so the allow only covers fake-root caps inside
   bwrap's own user namespace (scoped, harmless to the host);
   network/ptrace/file denies still hold independently.
2. bwrap brings up loopback in its new net namespace via a
   NETLINK_ROUTE socket: without network netlink raw, codex
   workspace-write fails with 'Failed to bind NETLINK_ROUTE
   socket' and no tool runs. And a bare 'deny network raw'
   overrides the netlink allow (deny wins over allow), so the
   raw deny must name inet/inet6 explicitly (verified by an
   isolated netlink bind test under each profile variant).
README correction in the same change: codex workspace-write
does NOT isolate /tmp -- an agent /tmp write lands on host
/tmp (verified). The verified boundary is: own worktree
writable, everything else read-only, /tmp shared.

deploy/apparmor/codex-host

@@ -38,29 +38,31 @@ profile codex-host flags=(attach_disconnected,mediate_deleted) {
   network inet dgram,
   network inet6 stream,
   network inet6 dgram,
-  deny network raw,
+  # bwrap brings up loopback in its new network namespace via a
+  # NETLINK_ROUTE socket (verified 2026-10-26: without this,
+  # codex workspace-write fails with "bwrap: loopback: Failed
+  # to bind NETLINK_ROUTE socket: Permission denied" and no tool
+  # runs at all). CAREFUL: a bare "deny network raw" would
+  # override this allow (deny wins over allow in AppArmor) and
+  # break netlink too -- verified by isolated netlink bind test.
+  # So the raw deny must name inet/inet6 explicitly, leaving
+  # netlink raw allowed.
+  network netlink raw,
+  deny network inet raw,
+  deny network inet6 raw,
 
-  capability chown,
-  capability dac_override,
-  capability fsetid,
-  capability fowner,
-  capability mknod,
-  capability net_bind_service,
-  capability setfcap,
-  capability setgid,
-  capability setpcap,
-  capability setuid,
-  capability sys_chroot,
-  deny capability sys_admin,
-  deny capability sys_ptrace,
-  deny capability net_admin,
-  deny capability net_raw,
-  deny capability sys_module,
-  deny capability sys_rawio,
-  deny capability sys_boot,
-  deny capability sys_time,
-  deny capability mac_admin,
-  deny capability mac_override,
+  # Capabilities: bwrap NEEDS userns-scoped capabilities (verified
+  # 2026-10-26: codex-host with deny capability sys_admin etc.
+  # made bwrap fail at userns creation, while the same profile
+  # with capability, allowed it). This is safe for an unprivileged
+  # user: codexsvc holds NO host capabilities, so the only caps
+  # this allows are fake-root caps inside bwrap's own user
+  # namespace (scoped to that namespace, harmless to the host).
+  # The profile's other denies still hold independently: raw
+  # network is gated by network rules, ptrace by ptrace rules,
+  # /proc/sys writes by file rules -- allowing caps does not
+  # void any of them.
+  capability,
 
   # bwrap needs these (docker-codex denies them).
   userns,