fix(build): close remaining mutable image inputs

bot_bottle/contrib/codex/Dockerfile

@@ -6,9 +6,8 @@
 ARG NODE_BASE_IMAGE
 FROM ${NODE_BASE_IMAGE}
 
-# The standalone installer is used below because remote-control requires its
-# managed package layout. Keep this exact release in sync with the verified
-# installer source and checksum.
+# Remote-control requires the standalone package layout. Keep this exact release
+# in sync with the committed upstream archive checksums.
 ARG CODEX_VERSION=0.145.0
 
 ARG DEBIAN_SNAPSHOT=20260724T000000Z
@@ -44,18 +43,29 @@ WORKDIR /home/node
 
 ENV PATH="/home/node/.local/bin:${PATH}"
 
-# Remote-control support requires the standalone Codex install layout under
-# ~/.codex/packages/standalone/current. Fetch the installer from the same
-# immutable release tag as the requested CLI, verify the committed checksum
-# before executing it, and let the official installer verify the selected
-# release archive against upstream release metadata.
-COPY --chown=node:node bot_bottle/contrib/codex/install.sh.sha256 /tmp/install.sh.sha256
-RUN curl -fsSL \
-      "https://raw.githubusercontent.com/openai/codex/rust-v${CODEX_VERSION}/scripts/install/install.sh" \
-      -o /tmp/install.sh \
-  && cd /tmp \
-  && sha256sum -c install.sh.sha256 \
-  && CODEX_NON_INTERACTIVE=1 sh /tmp/install.sh --release "${CODEX_VERSION}" \
+# Install the exact standalone release archive selected by the target
+# architecture. The checksum list is copied from the immutable upstream release
+# and committed so a rebuild cannot silently accept changed release bytes.
+COPY --chown=node:node bot_bottle/contrib/codex/codex-package_SHA256SUMS /tmp/codex-package_SHA256SUMS
+RUN case "$(dpkg --print-architecture)" in \
+      amd64) codex_target=x86_64-unknown-linux-musl ;; \
+      arm64) codex_target=aarch64-unknown-linux-musl ;; \
+      *) echo "unsupported Codex architecture: $(dpkg --print-architecture)" >&2; exit 1 ;; \
+    esac \
+  && codex_asset="codex-package-${codex_target}.tar.gz" \
+  && codex_sha256="$(awk -v asset="${codex_asset}" '$2 == asset { print $1 }' /tmp/codex-package_SHA256SUMS)" \
+  && test -n "${codex_sha256}" \
+  && curl -fsSL \
+      "https://github.com/openai/codex/releases/download/rust-v${CODEX_VERSION}/${codex_asset}" \
+      -o "/tmp/${codex_asset}" \
+  && echo "${codex_sha256}  /tmp/${codex_asset}" | sha256sum -c - \
+  && codex_release="/home/node/.codex/packages/standalone/releases/${CODEX_VERSION}-${codex_target}" \
+  && mkdir -p "${codex_release}" /home/node/.local/bin \
+  && tar -xzf "/tmp/${codex_asset}" -C "${codex_release}" \
+  && ln -s bin/codex "${codex_release}/codex" \
+  && ln -s "${codex_release}" /home/node/.codex/packages/standalone/current \
+  && ln -s /home/node/.codex/packages/standalone/current/bin/codex /home/node/.local/bin/codex \
+  && rm "/tmp/${codex_asset}" \
   && test "$(codex --version)" = "codex-cli ${CODEX_VERSION}"
 
 CMD ["codex"]

bot_bottle/contrib/codex/codex-package_SHA256SUMS

@@ -0,0 +1,2 @@
+54f79a05aba6f9abf8ef988abcae8bf2fcefba20beb549b4ff2b3acdb2cb6f54  codex-package-aarch64-unknown-linux-musl.tar.gz
+71a28d362c96ac9829bf8203a2c71be451aeb726adb843167fdaf0eae8fe7dd9  codex-package-x86_64-unknown-linux-musl.tar.gz

bot_bottle/contrib/codex/install.sh.sha256

@@ -1 +0,0 @@
-1154e9daf713aacd1534efca8042bfd6665ad24bc1d1dfd86b8f439fe60a7a5d  install.sh