Add full controlled Codex capability qualification

[KeyffMS]

Summary

Adds the full live C01-C16 qualification path for the trusted PlanAnvil Codex runner.

Trust boundary

• qualification workflow remains workflow_dispatch only;
• full qualification is accepted only from protected main;
• Environment remains plananvil-codex;
• runner selector remains [self-hosted, linux, x64, plananvil, codex];
• the self-hosted runner never handles PR events or untrusted branch code;
• the full job fetches only the exact dispatched main SHA into a disposable workspace created by plananvil-qualification-workspace;
• repository permissions remain contents: read and the runner never pushes evidence.

Live qualification controller

• processes C01 through C16 sequentially;
• materializes the prepared capability packages and validates them before execution;
• uses fresh codex exec --ephemeral invocations for setup, each trial, and evidence evaluation;
• pins gpt-5.6-sol, approval policy never, and disables network access for model-generated commands;
• uses read-only by default and workspace-write only for disposable fixture/worktree roots where a test requires mutation;
• permits hook-trust bypass only for the vetted protected-main fixture tests; sandbox and approval enforcement remain enabled;
• keeps only sanitized structured assertions, event-type counts, and relative Git-state observations; raw Codex session streams are not retained;
• rehashes and validates every evidence package after evaluation;
• exports evidence only as a short-lived GitHub Actions artifact;
• continues C01-C16 on individual BLOCKED/FAILED outcomes so one run produces a complete diagnostic matrix;
• final workflow status is green only when every release-gating capability is REPRODUCED.

Supporting changes

• regression tests for sanitization and qualification sandbox boundaries;
• controlled-runner procedure documented in the Codex sandbox runbook;
• changelog updated.

The Codex self-hosted workflow does not run on this PR. Only the existing seven required PlanAnvil checks should run before merge.