Add Linux headless MCP backend with Codex CLI and dual Oracle

[dsebban]

Summary

This brings the direct headless MCP backend to Linux and packages a self-contained, non-root Docker runtime with the official Codex CLI standalone payload.

The branch also carries the refreshed Secondary Oracle implementation that the headless Oracle path depends on. The earlier public Secondary Oracle PR (#686) was closed without merge, so this PR intentionally presents the integrated runtime rather than hiding that dependency.

Headless Linux runtime

• build the Linux MCP executable from the shared DirectHeadlessMCPService graph
• require the explicit --backend headless contract
• bundle Codex CLI 0.147.0 and its required helper/resources in the final Ubuntu 24.04 image
• run the final image non-root at uid/gid 65532 with an empty writable CODEX_HOME
• accept credentials only at container runtime; no .env, auth cache, API key, or login material enters build layers
• preserve native Codex workspace-write sandboxing; use the non-privileged container boundary as the external sandbox in Docker
• make POSIX socket/process identity handling portable across Darwin and Glibc

Dual Oracle

• preserve the single-Oracle route when Secondary Oracle is disabled
• run Primary and Secondary lanes concurrently with independent histories, IDs, models, failures, and launch carriers
• freeze one authoritative workspace/context route per paired invocation
• terminate provider process groups on cancellation

Validation

The fork branch has deterministic native-Linux and final-image MCP contract coverage. The harness exercises every tool advertised by the direct headless policy, verifies intentionally hidden tools remain unavailable, validates the final image payload and non-root boundary, and uses a fake Codex process with networking disabled so CI does not consume paid model requests.

I will keep this PR draft while upstream CI is being driven to green and then complete a final diff review.

[baron]

Blocking on exact head f799acb46d8abd7bc83d26cc901e7ea67492de09.

The Linux/headless work has merit, but this branch currently combines it with Dual Oracle scope now represented more narrowly by #782, and exact-head CI has PR-caused failures: Style (Package.swift), DirectHeadlessProcessTests, protected-mutation integration tests, and watchdog mutation-I/O timeouts. These are not all inherited from the base.

Please rebase/split the valuable Linux headless backend onto current main, remove the duplicated Dual Oracle authority in favor of #782's narrower path, fix the exact-head regressions, and rerun the full relevant hosted lanes. If that rewrite is not practical, close this large draft and open a focused headless-backend PR.

[morluto]

Audit disposition — split; Oracle portion superseded by #796 (2026-08-14)

This branch combines a Linux packaging/runtime product with a large Oracle redesign, making each depend on the other’s review and integration risk. #796 is now the preferred Oracle owner, with shared domain contracts and current exact-head coverage.

Please retire the Oracle half and recreate a Linux-only successor after the direct-headless and Oracle foundations settle. The Linux target should be expressed through explicit portable core products rather than a very large source-exclusion list, which is likely to drift as macOS files are added. Current normal macOS CI is also red, so this combined branch should not merge as-is.

[morluto]

Deep-review assessment — 2026-08-14

Disposition: split and supersede rather than merge this branch. The Oracle half is superseded by #796’s newer shared domain contracts, persistence/claim model, direct-headless parity, and green current-head CI. Keeping both implementations would create competing Oracle authorities.

Please close this combined PR and recreate a Linux-only headless-runtime PR on current main, rebased over the settled direct-headless and #796 foundations. The Linux work should avoid maintaining a giant platform-specific source-exclusion graph if a shared package/target boundary can express the supported runtime. Preserve the non-root image, no-build-secret boundary, pinned Codex payload verification, and native/final-image contract tests in that successor.