fix: support explicitly authorized Codex deployment without sandbox

Production agents repeatedly failed before SSH because the launcher only accepted workspace-write profiles. Accept the explicit Codex danger-full-access profile through the same validated plan and receipt path, and cover profile, argv and receipt validation with regression tests.

tests/test_ack_worker_profiles.py

@@ -323,7 +323,6 @@ class ProfileValidationTests(unittest.TestCase):
 
     def test_only_safe_permission_modes_are_accepted(self) -> None:
         for permission in (
-            "danger-full-access",
             "full-access",
             "yolo",
             "bypass",
@@ -337,6 +336,29 @@ class ProfileValidationTests(unittest.TestCase):
                 errors = worker_profiles.validate_orchestration(routing)
                 self.assertTrue(any("read-only/workspace-write" in error for error in errors))
 
+    def test_explicit_codex_full_access_routes_and_validates_receipt(self) -> None:
+        routing = valid_orchestration()
+        profile = routing["profiles"]["codex-dev-standard"]
+        previous_hash = worker_profiles.profile_hash(profile)
+        profile["permissionMode"] = "danger-full-access"
+        self.assertEqual(worker_profiles.validate_orchestration(routing), [])
+        self.assertNotEqual(worker_profiles.profile_hash(profile), previous_hash)
+        argv = worker_profiles.render_worker_argv(profile, "/usr/local/bin/codex", "/repo/demo")
+        self.assertEqual(argv[argv.index("--sandbox") + 1], "danger-full-access")
+        self.assertNotIn("--dangerously-bypass-approvals-and-sandbox", argv)
+        receipt = valid_receipt(routing)
+        self.assertEqual(worker_profiles.validate_worker_receipt(receipt, orchestration=routing), [])
+
+    def test_other_clis_reject_codex_full_access_permission(self) -> None:
+        for cli in ("cursor-agent", "grok", "omp", "pi"):
+            with self.subTest(cli=cli):
+                profile = dict(valid_orchestration()["profiles"]["codex-dev-standard"])
+                profile["cli"] = cli
+                profile["permissionMode"] = "danger-full-access"
+                if cli == "cursor-agent":
+                    profile["reasoningEffort"] = None
+                self.assertTrue(any("Codex" in error for error in worker_profiles.validate_profile(profile)))
+
     def test_reasoning_effort_is_required_for_codex_and_null_for_cursor(self) -> None:
         codex = valid_orchestration()
         codex["profiles"]["codex-dev-standard"]["reasoningEffort"] = None