Sandbox templates for Codex and Gemini

[adrianlungu]

From the README roadmap — parallel to the existing Claude sandbox template, add first-class templates for:

• Codex (OpenAI's Codex CLI) — `gocker sandbox run codex ./`
• Gemini (Google Gemini CLI) — `gocker sandbox run gemini ./`

What a template needs

Follow the Claude template pattern at `templates/claude/`:

• Dockerfile based on a minimal debian/alpine image
• Agent CLI pre-installed at the expected path
• Non-root user (AI agents refuse root for `--dangerously-skip-permissions`-type flags)
• Sandbox-required agent config baked in at `/home/sandbox/./`
• Entrypoint script that merges host config (`/.codex/`, `/.gemini/`) safely — strip host-specific keys (`hooks`, `installedPlugins`), keep portable ones (`enabledPlugins`, marketplaces)
• Memory allocation tuned to the agent's startup footprint

Publish path

• `docker.io/adyjay/gocker:codex-latest` / `:codex-`
• `docker.io/adyjay/gocker:gemini-latest` / `:gemini-`
• Add to `Makefile` `template-push` targets
• Wire weekly rebuild in `.github/workflows/template-images.yml`

Related

Pairs with the network-policy work (#6 → filed separately) — network-policy + per-agent template + config sync is the full story for "run X agent in a hardware-isolated, network-restricted sandbox".