fix: make public Codex assets readable in restricted containers

[teslashibe]

Scope

• Explicitly COPY public Codex JSON assets with mode 0644, independent of checkout umask.
• Exercise provenance smoke as UID/GID 1000:1000 with all capabilities dropped and no-new-privileges; assert both assets are readable.

Validation

• Repository Go gate passed: gofmt, go build ./..., go vet ./..., go test -race ./....
• Local linux/amd64 build used isolated tracked-source archive with both JSON source modes deliberately 0600.
• Restricted image smoke passed: assets 0644 root-owned and readable; UID/GID 1000:1000, zero capabilities, NoNewPrivs=1; health and supplied build provenance matched.
• No secrets, PVCs, or production changes. EU deployment is a separate operator handoff.

[teslashibe]

Release validation exception: GitHub check annotation confirms "The job was not started because your account is locked due to a billing issue." Authorized admin merge relies on completed local repository Go gate (gofmt, build, vet, race tests) and linux/amd64 restricted-image smoke with deliberately 0600 source assets, production UID/GID 1000:1000, dropped capabilities, no-new-privileges, readable 0644 assets, and verified health/build provenance. Exact reviewed head: 4c896dd; latest main: 0bdf30e. Only Dockerfile and .github/workflows/docker.yml changed. No EU deployment in this task.