fix. harden Go review flow

Fix runner bootstrap and auth handling, preserve queued SHAs, make event/job acceptance atomic, fence stale runs, correct retries and prompts, add fake end-to-end coverage, and fix deployment defaults.

Co-Authored-By: Claude <noreply@anthropic.com>

docker-compose.yml

@@ -3,22 +3,20 @@ services:
     image: mariadb:11
     restart: unless-stopped
     environment:
-      MARIADB_DATABASE: gitea_codex
-      MARIADB_USER: gitea_codex
-      MARIADB_PASSWORD: gitea_codex
-      MARIADB_ROOT_PASSWORD: rootpass
-    ports:
-      - "3306:3306"
+      MARIADB_DATABASE: ${DB_NAME:-gitea_codex}
+      MARIADB_USER: ${DB_USER:-gitea_codex}
+      MARIADB_PASSWORD: ${DB_PASSWORD:?DB_PASSWORD must be set}
+      MARIADB_ROOT_PASSWORD: ${MARIADB_ROOT_PASSWORD:?MARIADB_ROOT_PASSWORD must be set}
     volumes:
       - ./db:/var/lib/mysql
     healthcheck:
-      test: ["CMD", "mariadb-admin", "ping", "-h", "localhost", "-uroot", "-prootpass"]
+      test: ["CMD", "mariadb-admin", "ping", "-h", "localhost", "-uroot", "-p${MARIADB_ROOT_PASSWORD}"]
       interval: 5s
       timeout: 3s
       retries: 20
 
   bot:
-    build: .
+    image: gitea.reversed.dev/space/gitea-codex:latest
     depends_on:
       mariadb:
         condition: service_healthy
@@ -26,7 +24,6 @@ services:
       - .env
     volumes:
       - ./worktrees:/var/lib/gitea-codex/worktrees
-      - ~/.codex/auth.json:/root/.codex/auth.json:ro
       # The bot needs the host Docker API to launch isolated review containers.
       - /var/run/docker.sock:/var/run/docker.sock
     ports: