fix. harden Go review flow

Fix runner bootstrap and auth handling, preserve queued SHAs, make event/job acceptance atomic, fence stale runs, correct retries and prompts, add fake end-to-end coverage, and fix deployment defaults.

Co-Authored-By: Claude <noreply@anthropic.com>

docker-compose.dev.yml

@@ -2,16 +2,16 @@ services:
   mariadb:
     image: mariadb:11
     environment:
-      MARIADB_DATABASE: gitea_codex
-      MARIADB_USER: gitea_codex
-      MARIADB_PASSWORD: gitea_codex
-      MARIADB_ROOT_PASSWORD: rootpass
+      MARIADB_DATABASE: ${DB_NAME:-gitea_codex}
+      MARIADB_USER: ${DB_USER:-gitea_codex}
+      MARIADB_PASSWORD: ${DB_PASSWORD:?DB_PASSWORD must be set}
+      MARIADB_ROOT_PASSWORD: ${MARIADB_ROOT_PASSWORD:?MARIADB_ROOT_PASSWORD must be set}
     ports:
       - "3306:3306"
     volumes:
       - ./db:/var/lib/mysql
     healthcheck:
-      test: ["CMD", "mariadb-admin", "ping", "-h", "localhost", "-uroot", "-prootpass"]
+      test: ["CMD", "mariadb-admin", "ping", "-h", "localhost", "-uroot", "-p${MARIADB_ROOT_PASSWORD}"]
       interval: 5s
       timeout: 3s
       retries: 20
@@ -25,10 +25,11 @@ services:
       - .env
     environment:
       DATABASE_URL: gitea_codex:gitea_codex@tcp(mariadb:3306)/gitea_codex?parseTime=true
-      CODEX_AUTH_JSON_PATH: /root/.codex/auth.json
     volumes:
       - ./worktrees:/var/lib/gitea-codex/worktrees
-      - ~/.codex/auth.json:/root/.codex/auth.json:ro
       - /var/run/docker.sock:/var/run/docker.sock
     ports:
       - "8000:8000"
+
+# ChatGPT auth mode should use a separate local override that mounts the auth
+# file only when CODEX_AUTH_MODE=chatgpt. API-key mode needs no auth.json mount.