Fix Docker config state path: work/host-state.json, not /work/host-state.json

/work is a bind mount whose host dir docker auto-creates as
root:root, so the container user (1003:1004) cannot write a
state lock there (Permission denied, task fails in ~1s).
work/host-state.json resolves relative to the config dir /app
to /app/work/host-state.json, which maps via the extra mount to
the host work dir owned by codexsvc (uid 1003, same as the
container user), so it is writable. /app/host-state.json itself
is still unusable (/app is mounted read-only).

host-config-docker.json

@@ -1 +1 @@
-{"_note":"Docker 执行器专用配置（容器内路径，绝不是宿主路径）：state 必须在 /work（任务 worktree 挂载，可写），绝不能用默认的 /app/host-state.json——/app 在容器里是只读挂载，state 锁一开就报 Read-only file system，任务 1 秒内直接失败。此文件曾因 deploy 清理被删过（不在仓库里），导致 Docker 派发静默全灭，所以它必须进仓库、随部署一起发。sandbox 用 danger-full-access：主机内核禁止不可信 user namespace，Docker + 内层 bwrap 双重沙箱不可行，生产隔离层就是 Docker 本身。API key 绝不放这里，只走环境变量。","approval":"deny","approval_policy":"never","effort":"low","model":"gpt-6.1-sol","sandbox":"danger-full-access","state":"/work/host-state.json"}
+{"_note":"Docker 执行器专用配置（容器内路径，绝不是宿主路径）：state 必须用相对路径 work/host-state.json——相对配置文件所在目录 /app 解析，得到 /app/work/host-state.json，经额外挂载落到宿主 /opt/codex-app-server/work/host-state.json，属主是 codexsvc（uid 1003，与容器 --user 1003:1004 一致），容器可写。绝不能用默认的 /app/host-state.json（/app 是只读挂载，锁一开就报 Read-only file system），也绝不能用 /work/host-state.json（/work 挂载的宿主目录由 docker 自动创建、属主 root，容器用户写不进去，同样 1 秒内失败）。此文件曾因 deploy 清理被删过（不在仓库里），导致 Docker 派发静默全灭，所以它必须进仓库、随部署一起发。sandbox 用 danger-full-access：主机内核禁止不可信 user namespace，Docker + 内层 bwrap 双重沙箱不可行，生产隔离层就是 Docker 本身。API key 绝不放这里，只走环境变量。","approval":"deny","approval_policy":"never","effort":"low","model":"gpt-6.1-sol","sandbox":"danger-full-access","state":"work/host-state.json"}