Share MCP OAuth locks across Codex shadow homes - #4104

💭 I'm looking at the diff for CodexHomeLayout.ts and its test file to understand how it aligns with the Effect service conventions. I'm reviewing the changes against Effect conventions—adding the new directory to the known shared list, introducing a set for replaceable runtime directories, and adjusting the symlink logic to handle cases where a non-symlink file exists by removing and relinking it. Now I need to check the imports and any potential errors in the file. The code uses proper Effect namespace imports and Schema.TaggedErrorClass for errors, with Effect.catchTags for handling known tagged failures. The CodexShadowHomeFileSystemError preserves the actual cause rather than stringifying it, which aligns with conventions. Since this is a backend behavior change, tests were added as required. Looking at the error structure, the message getter derives from operation and path attributes, and the operation field uses Schema.Literals as a multi-value discriminator, which is acceptable per convention. The imports and code changes all follow Effect conventions properly. The modifications add the oauth-locks directory to shared paths, introduce a replaceable set, and adjust the symlink handling logic—all without violating error construction patterns or service conventions. The default behavior is set to fail safely. I'm working through the response format requirements. The check should return "All clear" when there are no findings, but the system also requires JSON output matching the schema. The JSON schema is the authoritative format, so I'll produce a success state with the appropriate title and summary reflecting that no violations were found.