Devcontainer: add the Codex VS Code extension, with AGENTS.md pointg to CLAUDE.md

[RyazanovAlexander]

What

• Pin OpenAI's Codex extension (openai.chatgpt@26.1007.21434) in .devcontainer/devcontainer.json. It ships its own CLI and sandbox for x86_64 and arm64, so the image installs nothing for it.
• Keep Codex's home (~/.codex: ChatGPT sign-in, settings, history) in a canvas-api-codex volume; the Dockerfile creates the directory so the volume is owned by vscode.
• Add AGENTS.md, which Codex reads: it sends Codex to CLAUDE.md as the single copy of the rules and names what stands in for Claude Code's own mechanics (review, live-run permissions, memory, the cloud-session exception).
• Record the decision as R69 (and amend R46); add the Codex row to docs/stack.html; add privacy question П-11 on what development agents may read, resolved by T72 before the first sample lands in samples/.

Checked

• Codex's sandbox runs inside the devcontainer: writes are confined to the workspace, network is off by default. Reads are not confined, which CLAUDE.md now says.
• just ci-lint, ci-test, ci-mocks-check, ci-licenses, ci-vuln, ci-secrets, ci-workflows, tf-check, release-version, ci-image-smoke, ci-image-scan, release-artifacts are green.

After merge

Rebuild the container and sign in to Codex with ChatGPT.

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Maintainability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE