fix: expose Codex admin sessions (ZER-718)

[ZeroPointSix]

What problem does this solve?

Slack @OpenAB Codex 能真实启动，但公网 OpenAB 前端看不到 Codex 会话详情。根因之一是 Codex 镜像未在配置 Admin 时启动 HTTP，且健康检查未覆盖 Admin 端口。

Closes #

Discord Discussion URL: None — discussion is in Slack C0BDF94JZEE / 1786779091.957439.

Review Contract

Goal

让配置了 Admin token / 显式 Admin 开关的 Codex 运行时真正启动 Admin HTTP，健康检查与启动条件一致，从而可读取 Codex 会话详情。

Non-goals

• 不合并 Claude 与 Codex 的进程内 SessionPool（统一 Admin 聚合层留给后续）。
• 不改 Admin 鉴权规则。
• 不在本 PR 内做生产部署。

Accepted Residual Risks

• 公网域名仍只反代 Claude 容器时，仅靠本 PR 不能让 openab.zerodotsixai.com 直接列出 Codex 会话；需要后续路由或聚合层（ZER-718 第二步）。Mitigation：先恢复 Codex Admin HTTP 监听与健康检查，便于独立验证与后续接入。
• Slack-only（Admin 关闭）容器继续用进程探针，不保证 HTTP 面可用。Mitigation：生产 Codex 若需要 Admin，必须配置 token 或 OPENAB_ADMIN_ENABLED=true。

Acceptance Criteria

• 配置 OPENAB_ADMIN_TOKEN / GATEWAY_ADMIN_TOKEN / OPENAB_ADMIN_ENABLED=true|1 时，进程启动 Admin HTTP。
• OPENAB_ADMIN_ENABLED=false 且无 token 时，Docker 健康检查走进程探针，不会因 HTTP 未监听而 unhealthy。
• 健康检查 HTTP 端口跟随 GATEWAY_LISTEN，不写死 8080。
• Docker smoke（codex / unified-codex）覆盖 admin=false 与自定义端口决策矩阵。
• PR 描述包含完整 Review Contract 小节。
• 分支已 rebase 到包含 admin_api_integration agent 断言修复的 main。

Follow-ups

• 统一 Admin 聚合层：按 instance_id + session_id 聚合 Claude/Codex sessions / transcript / SSE。
• 生产源站 103.235.73.216 SSH profile / 部署通道。
• 清理 Claude 实例无效 codex-max profile。

At a Glance

Slack Socket Mode ──► openab-codex (codex-acp)
                          │
                          ├─ Admin enabled? ──yes──► GATEWAY_LISTEN:/health + Admin API
                          │                              ▲
                          │                              │
                          └─ HEALTHCHECK ── openab-healthcheck.sh ──┘
                               (false flag => pgrep openab only)

Prior Art & Industry Research

Not applicable — this is a container healthcheck / Admin HTTP enablement bug fix aligned to existing OpenAB Admin behavior, not a new architecture.

OpenClaw: Not applicable — no multi-container Admin HTTP enablement change here.

Hermes Agent: Not applicable — same reason.

Proposed Solution

1. When Admin is enabled via env, start the embedded HTTP/Admin server even if no chat platform is active.
2. Replace Dockerfile.codex / unified-codex inline HEALTHCHECK with scripts/openab-healthcheck.sh, matching Rust admin_http_enabled_from_values() and reading port from GATEWAY_LISTEN.
3. Add shell unit tests and Docker smoke decision-matrix checks for OPENAB_ADMIN_ENABLED=false and custom listen ports.

Why this approach?

Keeps Slack-only Codex containers healthy without Admin, while making Admin-on containers report readiness only when /health works. Sharing one shell script between Dockerfiles and CI avoids the previous “non-empty string means enabled” bug.

Alternatives Considered

• Always start Admin HTTP：扩大攻击面，违背 Slack-only 隔离意图。
• 单独 Codex Admin 域名：可作为部署侧应急，但不能替代“探针与启动条件一致”。

Validation

Rust / shell:

• sh scripts/openab-healthcheck_test.sh (all cases passed locally)
• Unit coverage extended for admin_http_starts_for_explicit_flag_or_configured_token
• cargo test --features unified admin_http_starts_for_explicit_flag_or_configured_token (this sandbox has no Rust toolchain; relies on CI)
• Full cargo test / clippy via CI after push

Docker smoke (CI):

• Added codex decision-matrix steps in docker-smoke-test.yml and docker-smoke-test-unified.yml

All PRs:

• Rebased onto latest main (includes ZER-715 agent assertion fix that previously failed CI)
• Manual review of HEALTHCHECK vs Rust enable matrix

Changes (summary)

• Start embedded HTTP/Admin when Admin env enables it.
• Shared healthcheck script; port from GATEWAY_LISTEN.
• Codex image includes Admin path (prior commit) + healthcheck matrix (this commit).
• Version 0.9.11.

[linear-code]

ZER-718