feat: add external roots and acknowledged apply

[RomeoRaven]

Problem

Codex supports symlinked skill folders, but Codex Bridge correctly refused every target outside its declared roots. The current real Codex source therefore remained non-exportable. The plugin also stopped at snapshot export and could not create the fresh protoAgent agent.

Solution

• adds explicit external_skill_roots, empty by default;
• validates canonical, existing, distinct external roots;
• treats current/legacy symlinks into approved roots as covered aliases without following them through the original fence;
• scans each external root once as external-user with indexed provenance;
• keeps unapproved symlink targets refused and blocking;
• adds codex_apply_snapshot with fresh target name, explicit acknowledgement, and exact current plan SHA-256;
• refuses source drift, plan problems, snapshots containing plugins, duplicate targets, and credential input;
• calls protoAgent apply with install=false and an empty secrets map.

Tests

• PROTOAGENT_SOURCE=<current protoAgent checkout> .venv/bin/pytest -q - 28 passed
• Ruff check and format passed.
• Real-source read-only proof with six explicit external skill directories produced 19 skills, zero plan problems, unchanged source hashes, and a snapshot accepted by protoAgent with zero plugins and runs_code=false.
• Exact-commit isolated lifecycle passed install-disabled, enable/load, unacknowledged refusal, fresh-agent apply (complete=true), duplicate refusal, workspace purge, disable/re-enable, uninstall, and empty final plugin inventory.

Scope

No arbitrary symlink following, in-place merge, credential input, Codex plugin/persona/policy migration, release, stable installation, Windows claim, PC1 work, or active primary/development pA runtime use.

Closes #3

Prepared by Hermes with AI assistance.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 25af3690c8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve in-root skill aliases instead of refusing them

When a current, legacy, or repository skill alias resolves to another directory inside the same declared skill root, it cannot match any external_root, so this branch incorrectly reports it as an outside-root refusal. The canonical directory is still scanned successfully, but the spurious entry in plan.problems prevents both snapshot export and codex_apply_snapshot; first check the existing fence and silently skip aliases that remain within it, as the previous implementation did.

Useful? React with 👍 / 👎.