feat: add governed Codex coworkers, full computers, and custom avatars

[FsDevNinja]

Summary

Custom avatars

• let the signed-in person upload, replace, and remove a PNG, JPEG, or WebP avatar from Settings
• let Bot owners and administrators customize Bot avatars, including deployment-local branding for packaged Bots
• validate decoded size, image signature, and dimensions; serve authenticated private versioned image URLs without embedding image payloads in roster JSON
• render the same image across settings, sidebar, channels, recipients, handoffs, and coworker dialogs

Governed Codex coworker

• add a local Codex coworker that uses the host's signed-in Codex subscription and resumes durable OpenBot-owned Codex threads
• route assigned tools through OpenBot's signed grant, policy, and audit gateway
• disable native Codex shell, file, web, browser, computer, app, plugin, MCP, and multi-agent paths before startup; strip OpenBot and provider credentials from the child process
• refuse stale, replayed, malformed, and duplicate tool callbacks

Isolated graphical computers

• expose the full Linux desktop for per-Bot computers, with Browser and Terminal launchers that survive a managed-browser close
• issue short-lived actor-bound control capabilities checked at HTTP, WebSocket, VM upgrade, and every input event
• keep shared providers on the Bot-scoped page stream so one Bot cannot see another Bot's desktop
• add Kubernetes sandbox/VM mode support, explicit Kata RuntimeClass validation, rolling-upgrade fallback, and release/chart image coherence

Documentation and release notes

• document local Codex setup, graphical computer topology, configuration, development, deployment, and avatar behavior
• update the Unreleased changelog and Helm chart metadata

Test Coverage

Avatar path
  picker -> client validation -> authenticated API -> PostgreSQL
  -> private versioned URL -> every avatar surface -> removal fallback
  [9/9 paths covered]

Codex path
  scrubbed child -> native features off -> durable thread
  -> assigned dynamic tool -> grant/policy/audit gateway -> result
  [8/8 paths covered]

Computer path
  Bot access -> actor-bound lease -> same-origin socket proxy
  -> isolated desktop -> per-event check -> release/expiry
  [10/13 paths covered; deployed cloud/Kata lifecycle remains environment-bound]

AI-assessed release-path coverage: 27/30 paths (90%), above the 80% target.

Tests: 176 -> 190 files (+14).

Pre-Landing Review

No issues found after the review-fix commits. Fresh review covered SQL/data safety, concurrency, trust boundaries, native Codex escapes, computer authorization, release workflows, and changed frontend files.

Design Review

Design Review (lite): 0 findings. Both avatar upload flows were also exercised in a real browser at desktop width.

Eval Results

No prompt-related source files changed, so evals were not required.

Plan Completion

No implementation plan detected. The branch has a current ship test plan and QA report.

Verification Results

• bun run test: 2,217 passed, 25 intentional runtime/browser skips, 0 failed across 190 files
• bun run typecheck: pass
• bun run lint: pass, zero warnings
• bun run format:check: pass
• bun run build: pass
• browser verification: current-user avatar upload, reload persistence, rendering, removal, and initials fallback pass
• browser verification: packaged Codex Bot avatar upload, reload persistence, rendering, removal, and generated-avatar fallback pass
• prior release-path QA: real Chromium/Xvfb lifecycle, Helm targets including Kata VM mode, and fresh all-in-one image build pass

Test plan

• Full Bun test suite passes
• All workspace TypeScript checks pass
• Lint and formatting checks pass
• Production build passes
• Both avatar upload/remove flows pass in a real browser
• Upstream main is merged and verified

Generated with Codex and pstack

Documentation

• README.md: added custom avatars to the feature list and clarified the Agents and Settings routes.
• docs/README.md: made avatar guidance discoverable from the docs index.
• docs/coworkers.md: documented person/Bot upload permissions, packaged-Bot branding, removal fallbacks, validation, storage, and short image URLs.
• docs/architecture.md: documented the PostgreSQL image fields and authenticated versioned image delivery.
• CHANGELOG.md: added the user-facing avatar upload release note.
• Codex, deployment, development, Helm, and graphical-computer documentation remains current from the earlier branch docs pass.

[FsDevNinja]

Opened against the upstream repository in error. The intended pull request is FsDevNinja#1.