fix: make Codex delivery resilient to sandbox DNS

[Greg-Moskalenko]

Summary

• keep Codex workspace-write turns network-enabled only when the adapter proves it honors Buzz's explicit network and writable-root policy
• add a harness-owned broker that transports the exact already-signed Buzz event when the sandboxed CLI has a degraded or ambiguous relay outcome
• verify relay acceptance and exact event readback for both direct and brokered delivery
• preserve message content, channel/thread tags, mentions, attachments, signer, and event id without reconstructing or re-signing the payload
• retain one deferred heartbeat when a lazy agent pool is asleep, wake the pool through the existing retry/backoff path, prioritize human work and shutdown, and dispatch the heartbeat exactly once after readiness

Why

Codex turns could compose valid Buzz replies while normal buzz messages send calls ran inside a workspace-write sandbox whose per-turn policy disabled network access. Delivery then depended on a model-selected elevated retry.

A separate scheduler edge also let a managed agent appear online while native heartbeat ticks were dropped: lazy-pool startup left pool_ready=false, the heartbeat branch skipped unready pools, and a heartbeat did not itself create wake demand.

This change makes the intended workspace-write network policy explicit, adds a signed-event delivery contract outside the model sandbox, and turns a heartbeat that arrives during lazy sleep into bounded deferred work rather than silently discarding it.

Safety properties

• direct relay delivery remains the primary path
• broker accepts only a bounded message-kind allowlist and validates signer, signature, event id, membership, channel tags, timestamps, size, capability, and request correlation
• broker publishes the exact signed event, performs exact readback, and never rebuilds or re-signs assistant prose
• bounded queue, scan, response, timeout, lease, symlink/reparse, and stale-file handling
• stock adapters fail closed at startup; the required adapter capability is versioned
• deferred heartbeat state is one bit, repeated sleeping ticks coalesce, wake failures retain demand for the existing retry/backoff, human events and shutdown remain higher priority, and debt is consumed only on dispatch

Validation

Exact head: d815befc9321f24ac1afa572d17eea183fd3297b (merged with upstream 9213090f6076bf3b7667b9b984752b3e47ef8f2f).

• env -u BUZZ_ACP_LAZY_POOL just ci — full repository CI passed
• full buzz-acp package validation passed: 714 unit tests and 9 lifecycle tests
• four focused deferred-heartbeat regressions passed, including coalescing and failed-wake/backoff persistence
• independent scheduler/concurrency review completed; deferred dispatch was moved into the biased select after relay/inactivity/shutdown priority and after respawn collection
• isolated live proof passed: one sleeping heartbeat was deferred, woke a one-agent lazy pool, reached pool ready, fired once, returned the exact local nonce, used zero tools, and made no source reads, relay writes, or state mutations
• the normal managed runtime was restored on the hash-pinned candidate at 32 agents, 3600-second cadence, lazy listening, and full channel subscription

Dependency and merge gate

Paired adapter change: agentclientprotocol/codex-acp#368.

Keep this PR draft. Do not merge until the compatible adapter is available to the Buzz package/runtime, required upstream review and checks pass for the exact head, the Apps manual merge gate is explicitly cleared, and the next normal-cadence production heartbeat confirms the end-to-end notification behavior without duplicate routing or checkpoint drift.