fix: preserve logical Codex identity across verified runtime resolution

[cmyk]

Summary

This is a follow-up to merged PR #10 for the reviewed Thin-v6 Codex runtime-identity repair.

The installed candidate at source commit 9009dae32f15f147f57165e6623414c6c23b0967 reproduced the Codex relay DNS failure: the initial delivery command failed network resolution, Codex retried through Guardian-reviewed elevated network access, and signed delivery eventually succeeded.

Desktop's verified runtime resolution canonicalized the logical codex-acp command to its executable target, .../codex-acp/dist/index.js. Desktop then passed that executable path where buzz-acp expected a logical runtime identity. Because the basename was the generic index.js, Codex-specific CODEX_CONFIG network injection was skipped.

This patch separates the trusted logical runtime identity from verified executable provenance:

• Desktop continues to spawn only the canonicalized, content-verified executable.
• The verified runtime plan separately projects its trusted provider family as BUZZ_ACP_AGENT_IDENTITY.
• buzz-acp uses that identity for Codex policy and other runtime-specific defaults while retaining the verified command for execution.
• The identity key is reserved: inherited, persona, custom harness, agent, and baked environment layers cannot forge a builtin identity. Only the existing trusted runtime-plan resolver reintroduces it after executable verification.

The exact production contract is covered end to end: Desktop resolves through the real Codex catalog mapping and emits identity codex; buzz-acp consumes identity codex; and a spawned generic .../dist/index.js probe observes CODEX_CONFIG.sandbox_workspace_write.network_access=true.

Observer telemetry for this runtime changes from codex-acp to the canonical logical identity codex.

Provenance

• Base: 898d562b01dda584ba42f6d6fb50c0ff7638f469
• Source commit reviewed before rebasing: 9629d3b8ac35f95a755159f89a28ee5464b6db5e
• The follow-up commit was cherry-picked with -x and preserves its Signed-off-by trailer.
• The stable patch ID matches the reviewed source commit.

Verification

• cargo test -p buzz-acp config::tests — 114 passed
• cargo test -p buzz-acp acp::tests::spawn_ — 2 passed
• Desktop managed_agents::runtime_plan::tests — 4 passed
• Desktop managed_agents::runtime::tests — 60 passed
• Desktop managed_agents::env_vars::tests — 42 passed
• Root Rust formatting check — passed
• Desktop Rust formatting check — passed
• Desktop source-size ratchet against 898d562b01dda584ba42f6d6fb50c0ff7638f469 — passed
• git diff --check — passed
• Scope audit — exactly the reviewed nine files; no workflows, manifests, dependencies, or lockfiles changed

No app build, packaging, launch, GUI automation, or packaged acceptance has run for this follow-up.

Do not merge until separately approved.

[reinhold-ph]

APPROVE — no blocking findings in exact head 241ce7f49542d3dd7551cfb277244196a5c9ffe8.

The rebased commit is one ahead/zero behind merged PR #12 main, preserves DCO and provenance, and has the same stable patch ID as the previously reviewed identity repair. GitHub reports the same resulting blob SHA for each of the nine changed files as old reviewed head 56a31702d23dcafbec0ef50c32c89a530f8ab14d; no resolver, workflow, manifest, dependency, migration, or lockfile changes entered the PR.

Executor verification on this exact head reports 114 config tests, the targeted ACP spawn regression, 4 runtime-plan tests, 52 environment tests, formatting, and diff checks all passing. The prior combined candidate had a source tree identical to this head and passed bundled-sidecar/network acceptance. Per the exact-head product gate, the final package still needs to be rebuilt from 241ce7f4... before merge.