Persist Codex login across container rebuilds

.devcontainer/Dockerfile

@@ -129,6 +129,11 @@ RUN python3 -m venv /opt/playwright && \
 # cannot write the ~1.5 GB of toolchain into it.
 RUN install -d -o vscode -g vscode -m 0755 /home/vscode/.platformio
 
+# Codex keeps its login and local configuration here. The devcontainer variants mount a
+# named volume over this path so those files survive a rebuild. Seed its ownership from
+# the image; otherwise a newly created Docker/Podman volume is owned by root.
+RUN install -d -o vscode -g vscode -m 0700 /home/vscode/.codex
+
 # GitHub's SSH host key, so that the first git operation in a fresh container verifies
 # against something rather than failing with "Host key verification failed" - which is
 # what it does today, because ~/.ssh belongs to the container and is empty after every

.devcontainer/README.md

@@ -11,6 +11,13 @@ Choose the configuration matching the host. Keeping the WSLg mount in its own
 configuration prevents native Linux container startup from failing when
 `/mnt/wslg` does not exist.
 
+## Persistent Codex login
+
+Both configurations mount the named `wordclock-codex` volume at
+`/home/vscode/.codex`. This preserves the Codex login and local configuration
+when the development container is rebuilt. The volume contains credentials; do
+not share, export or remove it unless the saved login should be discarded.
+
 ## SSH agent on Linux
 
 The Linux variant mounts the host's `SSH_AUTH_SOCK` at the fixed path
@@ -185,10 +192,9 @@ be committed (internal base images, registry-hosted features, credentials). The
 Add such a directory to `.gitignore` to keep it local; `/.devcontainer/vector/`
 is already listed there.
 
-Anything that persists credentials belongs in such a variant rather than in the
-committed ones. Persisting a tool's login across rebuilds, for instance, takes a
-named volume plus one `chown`, because a volume whose target does not exist in
-the image is created owned by root:
+Persisting another tool's login across rebuilds takes a named volume plus one
+`chown`, because a volume whose target does not exist in the image is created
+owned by root:
 
 ```jsonc
 "mounts": [

.devcontainer/linux/devcontainer.json

@@ -27,6 +27,7 @@
     ],
     "mounts": [
         "source=/tmp/.X11-unix,target=/tmp/.X11-unix,type=bind",
+        "source=wordclock-codex,target=/home/vscode/.codex,type=volume",
         "source=${localEnv:SSH_AUTH_SOCK},target=/tmp/ssh-agent,type=bind"
     ]
 }

.devcontainer/wslg/devcontainer.json

@@ -17,6 +17,7 @@
     },
     "mounts": [
         "source=/tmp/.X11-unix,target=/tmp/.X11-unix,type=bind",
-        "source=/mnt/wslg,target=/mnt/wslg,type=bind"
+        "source=/mnt/wslg,target=/mnt/wslg,type=bind",
+        "source=wordclock-codex,target=/home/vscode/.codex,type=volume"
     ]
 }