Host-level sandbox tasks: LocalExecutor + bwrap workspace-write

Docker outer layer and bwrap inner layer are mutually exclusive
on this host (fresh proc mounts fail with kernel EPERM inside
Docker's nested pidns, but work on the host under a userns
profile). So tasks that need an inner sandbox run on the host:
- Worker --claim-executor-only: strict executor claim (only
  executor == own type, never NULL). The host worker MUST use
  it, or it would steal NULL-executor tasks meant for Docker
  workers (those tasks would lose the Docker outer layer).
  Default behavior unchanged (NULL claimable by any worker).
- host-config-host.json: sandbox workspace-write, state
  work/host-state-host.json (distinct from Docker tasks'
  host-state.json), same relay home and test repo as Docker.
- deploy/apparmor/codex-host: docker-codex base + userns,
  mount, pivot_root for bwrap; still denies raw network,
  ptrace, dangerous capabilities, /proc/sys writes.
- deploy/host-worker/codex-host-worker.service: aa-exec -p
  codex-host, --executor local --claim-executor-only,
  capacity 2, proxy env 127.0.0.1:8888 so host tasks' relay/git
  egress also goes through the Tinyproxy allowlist (host direct
  egress would bypass it).
POST /tasks already accepts executor (local/docker/cloud), so
no API change was needed for routing.
Tests: 4 host-sandbox-routing tests (strict claim incl. CAS,
default still takes NULL, config sandbox/state, profile
allows bwrap without deny mount). Full suites pass.

cloud/README.md

@@ -507,6 +507,23 @@ interrupted 且终态任务 cancel 返回 400、心跳后 sweep 不扫刚心跳
   从记忆里拼一个 allowlist 极易漏掉 codex 工具链要的系统调用
   而静默破坏任务，正确的更严 profile 需要先对 codex 做系统
   调用画像，那是下一项工作，不是本轮假装做到的。
+- 宿主级沙箱任务（与 Docker 任务二选一，绝不叠加）：
+  codex 的 workspace-write（bwrap）在 Docker 容器内不可行
+  （嵌套 pidns 下 fresh proc mount 内核 EPERM，宿主级则可用），
+  所以需要内层沙箱的任务改走宿主级：worker 用 LocalExecutor +
+  `host-config-host.json`（sandbox workspace-write，state 独立
+  为 work/host-state-host.json），以 `aa-exec -p codex-host`
+  运行（见 `deploy/apparmor/codex-host`：docker-codex 基础 +
+  userns/mount/pivot_root，仍禁 raw/ptrace/危险 capability），
+  并带 `HTTP(S)_PROXY=http://127.0.0.1:8888` 让 relay/git 出口
+  同样走 Tinyproxy 白名单。路由靠任务的 executor 字段
+  （POST /tasks 已支持 local/docker/cloud）：宿主 worker 必须
+  开 `--claim-executor-only`，只认领 executor='local' 的任务，
+  绝不抢 executor 为 NULL 的任务（否则会把本该进 Docker 的
+  任务拉到宿主上跑，丢了 Docker 外层）。宿主任务放弃 Docker
+  外层（无容器、无租户挂载/网络隔离），换来的是 bwrap 内层
+  （agent 只能写自己 worktree，/tmp 是隔离的 tmpfs，写不到
+  宿主 /tmp；其它任务 worktree 与宿主文件同样不可见）。
 - 网络白名单的诚实边界：docker run 默认 bridge 网络，本执行
   器不做 egress 白名单——真正的“只放行模型 API”需要宿主防火
   墙或代理规则，那是部署项，不是本轮代码假装做到的，不要宣称