ci(track-a): repair absolute xkbcomp helper path on dedicated runner

[blakinio]

Track A bounded dedicated-runner helper repair

Task: OTC-20260816-track-a-runner-system-xkbcomp-repair
Base: exact current main@22089c5ca65228379c409dd33561a096eea00b16.
Execution: one bounded synology-otclient-01 support-filesystem repair plus isolated Xvfb validation; no official-client runtime access.

Isolated Xvfb evidence #387 proves zero unresolved shared libraries but rc=1 before socket because this Xvfb build invokes missing absolute /usr/bin/xkbcomp. Read-only inventory #388 proves the exact helper already exists inside the trusted persistent root as root-owned executable /work/_otclient_tibia_re_state/toolroot/usr/bin/xkbcomp, SHA 0967e7e7b03b077327cea74567726b265bd304b4fdf59f87bf7fdfe1074e7591, while /usr/bin/xkbcomp and current system packages are absent.

This task will:

• re-prove source path/realpath/uid/mode/SHA and zero missing dynamic libraries;
• require job UID 0 and writable /usr/bin; otherwise stop with explicit runner-image deployment blocker and no change;
• require target absent or already safe/bit-identical;
• atomically publish only /usr/bin/xkbcomp from the proven source;
• prove exact source/target hash equality;
• run one isolated Xvfb exact invocation on a high display and require socket creation;
• on any post-publication failure, remove only the newly created helper and clean only the task-owned Xvfb process/lock/socket.

No client, VNC, WARP, canonical lease/registration/session, game network/login, credentials, /proc inventory or Track B surface is touched. A successful copy is an immediate container repair, not a substitute for declarative runner-image provisioning.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.