fix(harness): install codex deps correctly (prerelease + Volcengine mirror)

[yaozheng-fang]

Problem

The harness image (init template + generated Dockerfile) appended openai-codex to the main install line:

RUN uv pip install --system --index-url https://mirrors.aliyun.com/pypi/simple/ \
        ./src fastapi "uvicorn[standard]" openai-codex

This fails the build: openai-codex and its bundled openai-codex-cli-bin are pre-release only, so uv refuses them without --prerelease=allow (all versions of openai-codex cannot be used … pre-releases weren't enabled).

Fix

Split the codex dependency into its own step with --prerelease=allow, pulling from the Volcengine pypi mirror (it carries the pre-release wheels — confirmed openai-codex-cli-bin==0.137.0a4 — and is the fastest/most reliable source since the build runs on Volcengine infra):

RUN uv pip install --system --index-url https://mirrors.aliyun.com/pypi/simple/ \
        ./src fastapi "uvicorn[standard]"
RUN uv pip install --system --prerelease=allow \
        --index-url https://mirrors.volces.com/pypi/simple/ \
        openai-codex

Verification

Deployed a harness from this template and confirmed --runtime codex works end-to-end:

• agentkit invoke harness <name> "..." (adk, default) → no local file access (explains how to run ls ~).
• agentkit invoke harness <name> "..." --runtime codex → actually lists the home directory (.bashrc, .config/, .local/, …) — codex backend has shell/file access.
• Cloud build via the Volcengine mirror completed in ~3 min (vs PyPI egress timing out at the 15-min limit).

Follow-up to #72 (re-land), which merged with the codex install in its broken first form.

🤖 Generated with Claude Code