fix(harness): pin codex deps so the harness image builds on glibc

[yaozheng-fang]

Problem

The harness Dockerfile (init_executor._HARNESS_DOCKERFILE) installed openai-codex unpinned, which failed the cloud build:

1. openai-codex is prerelease-only (0.1.0bX) → uv rejects it without an explicit version (pre-releases weren't enabled).
2. --index-url pointed only at the aliyun mirror, which lagged the prerelease of openai-codex-cli-bin and fell back to an older 0.132.0 that ships no manylinux wheel → platform mismatch on the glibc (bookworm) base.

Fix

Pin both to exact versions:

RUN uv pip install --system --index-url https://mirrors.aliyun.com/pypi/simple/ \
        ./src fastapi "uvicorn[standard]" \
        openai-codex==0.1.0b3 openai-codex-cli-bin==0.137.0a4

• An exact == pin auto-enables that prerelease in uv (no global --prerelease=allow).
• Forces openai-codex-cli-bin==0.137.0a4, whose manylinux_2_17 x86_64/aarch64 wheel matches the glibc image. aliyun now mirrors this prerelease, so everything installs from the single fast domestic mirror in one step (no pypi.org fallback / no bandwidth contention).
• ENV UV_HTTP_TIMEOUT=300 for the large (86MB) codex engine binary + google-adk on slow build networks.

Verified end-to-end (cloud)

• Build Succeeded (~2:44, all aliyun); runtime created and reached Ready.
• --runtime codex invoke works: returned 2 for "1+1", and on request executed shell commands inside the container (whoami → root, $HOME → /root, pwd → /app) — confirming import openai_codex + the cli-bin engine + tool execution all work.

🤖 Generated with Claude Code