Add OmegaFlow controlled-session conformance

[omry]

Add a pinned Linux amd64 conformance workflow that drives the public controlled-session host and controller-client boundary through unmodified asciinema and Playwright. Cover persistent terminal and browser handoff, retained artifacts, and failed output finalization with completed and acknowledged results.

Allow controller packaging to resolve local staged generation tags through the locked image identity, and preserve a healthy controller channel when workload exit is first observed after the output-finalization deadline.

Run the conformance workflow uncached in Linux amd64 integration CI and add arm64 asciinema fixture metadata for the existing cross-architecture attachment coverage.

---

Stack created with Sapling. Best reviewed with ReviewStack.

• -> Add OmegaFlow controlled-session conformance #53
• Add controlled-session host invocation #52
• Package focused controlled-session client #51
• Add controlled-session terminal attachment #50
• Add embedded controlled-session broker #49
• Freeze OmegaFlow controlled-session integration contract #48
• Persist controlled-session controller outputs #47
• Normalize controlled-session protocol and add client readiness #46
• Start 0.7 development cycle #45
• Compose current controlled sessions #43
• Prove controlled-session network isolation #42
• Integrate controlled-session networking #41
• Persist controlled-session network ownership #40
• Add controlled-session network adapter #39
• Plan controlled-session networking #38
• Retry controlled-session watchdog cleanup #37
• Persist controlled-session crash receipts #36
• Fail closed when session watchdog exits #35
• Launch controlled-session watchdog #34
• Prepare controlled-session cleanup manifest #33
• Record controlled-session resource ownership #32
• Prove controlled-session lifecycle in Docker #31
• Supervise controlled-session lifecycle #30
• Bridge controlled-session controller and workload I/O #29
• Add Docker controlled-session controller adapter #28
• Add Docker workload PTY adapter #27
• Add private controlled-session channel #26
• Freeze controlled-session execution plans #25
• Add bounded controlled-session PTY draining #24
• Enforce controlled-session output finalization #23
• Verify sandbox state on the execution thread #22
• Preserve base identity in direct installs #21
• Run application sandbox integration in CI #20
• Add controlled-session lifecycle state machine #18
• Add controlled-session framed protocol #17
• Define controlled-session authorization #16
• Make queued admission cancellation deterministic #15
• Enforce coarse application network policy #14
• Protect host system trees from runtime binds #13
• Enforce root host filesystem boundary #12
• Add container-local runtime identities #11
• Verify application sandbox at startup #10
• Harden application container identity and kernel policy #9
• Unify application sandbox planning #8
• Document controlled sessions and repositories #7

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[omry]

@codex review 5145fa4

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 5145fa4a7d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".