feat(overlay-open-skill-2): govern openai/codex codex-bug with consumed attenuation

[jdjioe5-cpu]

Summary

• Adds skills/overlay-open-skill-2/ — a governed overlay wrapping openai/codex codex-bug/SKILL.md (Apache-2.0) under a pinned sha256 digest, a non-empty scope bound, an explicit allowed-tools set, an allowed_output_prefix attenuation that is actually consumed at execution, a max_skills cap that is actually enforced, and a seal-bearing approval gate that fires when the wrapped guidance names any of six security/compliance/network/credential/secret/publish keywords.
• 4 inline harness cases in X.yaml: pinned-digest-seals, digest-stale-refuses, attenuation-violation-refuses, approval-required-pending. All four pass under runx harness skills/overlay-open-skill-2/SKILL.md --json.
• 4 standalone replay fixtures under fixtures/ mirror the inline cases for public replay.
• Companion documents: evidence.json, verification.json, HARNESS_EVIDENCE.md, REPORT.md.

Bound check (consumed)

• runner.scopes: ["repo.read"] — non-empty.
• runner.allowed_tools: ["shell.exec", "fs.read"] — non-empty, non-wildcard.
• allowed_output_prefix: "./.runx/bug-triage/" — every emitted output_path is normalized and startsWith-checked at execution. /etc/passwd → refused with runx.overlay.attenuation.violation.
• max_skills: 1 — every nested_skill_calls is integer-compared against the cap. Over-cap → refused with runx.overlay.attenuation.violation.
• approval.gate_keywords: [security, compliance, network, credential, secret, publish] — when the wrapped guidance preview names any of these, the wrapper seals a pending_approval receipt with a deterministic approval_token and stops. A subsequent invocation supplying the matching token clears the gate and seals ready.

Refusal paths

• runx.overlay.digest.stale on digest mismatch.
• runx.overlay.scope.empty / runx.overlay.tools.unbounded on missing bounds.
• runx.overlay.attenuation.violation on path outside allowed_output_prefix or nested-skill count over max_skills.
• runx.overlay.approval.required on gate-keyword hit.
• runx.overlay.approval.rejected on a stale or unrelated approval_token.

Verification

• Source commit: 4e46bc93876c7366eac7ccf48e5749d0e3af9208
• runx --version reports runx-cli 0.6.14 (meets runx_cli_min_version: 0.6.14).
• Inline harness passed (4/4 cases, 0 assertion errors).
• Each of the 4 receipts verifies with signature_mode: production, valid: true, no findings.

Test plan

• Replay inline: runx harness skills/overlay-open-skill-2/SKILL.md --json.
• Replay standalone: runx harness skills/overlay-open-skill-2/fixtures/<case>.yaml --json.
• Verify each harness receipt: runx verify --receipt-dir .runx/receipts <id> --json.
• Dogfood: runx skill ./skills/overlay-open-skill-2/SKILL.md -i objective=... -i output_path=./.runx/bug-triage/case.md -i resolved_digest=sha256:cfdaae2defa524d9f2fb8573bb0e4961c99e2237d48666d9007e0ef5d210cbbf --json.

Upstream identification

• Wrapped: https://raw.githubusercontent.com/openai/codex/main/.codex/skills/codex-bug/SKILL.md
• Repo: https://github.com/openai/codex (MIT/Apache-2.0 mix, public).
• License of wrapped bytes: Apache-2.0.
• Distinct upstream from any companion overlay (this is a bug-triage guidance skill; the prior overlay-open-skill-2 attempts wrapped code-review-testing and other guide-style skills).