bug(agents): gator Codex policy blocks oaiusercontent.com and auto-approval leaves proposals pending #4885

Related to #3469. Found while running gator from #4744 on a remote Kubernetes gateway.

User Story

I run gator in an OpenShell sandbox with the Codex harness. Its policy denies Codex's own asset downloads, and the resulting policy proposals stay pending even with proposal_approval_mode=auto. I need the gator Codex provider policy to cover the hosts Codex actually uses, so that watch cycles don't generate denials and proposals that need a human.

Problem Statement

scripts/agents/gator/providers/codex-gator.yaml allows chatgpt.com, ab.chatgpt.com, and files.openai.com. It does not allow OpenAI's regional asset hosts under *.oaiusercontent.com. Within seconds of each Codex start, Codex tries sdmntprsouthcentralus, sdmntprcentralus, sdmntprsoutheastus3, and sdmntpreastus2.oaiusercontent.com:443. This is right after GET /backend-api/ps/plugins/list, which suggests plugin asset downloads. The sandbox denies each one (policy_dns_ineligible, transparent_tcp_policy_denied) and stages a policy proposal.

With agent_policy_proposals_enabled=true and proposal_approval_mode=auto set on the sandbox, proposal batches were submitted at two points in the first cycle. In each batch, the gateway auto-approved the first chunk ("no new prover findings") and logged auto-approval failed; chunk remains pending for human review for every later chunk: 2 approved and 5 failed in total. After the first batch, sdmntprsouthcentralus was allowed, but the other three hosts kept being denied. The approval-triggered policy reload also closed an in-flight tunnel (L7 tunnel closed before inspection because policy changed: policy generation is stale). openshell logs shows the warning without its error field, so the reason the auto-approval failed isn't visible to the operator. The first-succeeds, rest-fail pattern suggests the later chunks are checked against a policy revision that the first approval already replaced. That cause hasn't been confirmed.

Impact / Why This Matters

• Every gator launch adds medium-severity denials and pending proposals that someone has to review or ignore.
• The Codex features behind these downloads silently fail inside the sandbox.
• The approval failure reason is hidden, so an operator can't tell a safe-to-ignore failure from a real problem.

Acceptance Criteria

• Someone decides whether gator needs these downloads. If it does, the gator Codex provider policy allows the required oaiusercontent.com hosts, scoped to the Codex binaries. If it doesn't, Codex is configured not to fetch them.
• A fresh gator launch logs no oaiusercontent.com denials and creates no pending policy proposals for them.
• When proposal auto-approval fails, the failure reason is visible to the operator (for example in openshell logs or the proposal's state).
• Either every eligible chunk in a multi-chunk batch is auto-approved, or the documented reason why later chunks are left pending is shown to the operator.

Reproduction Steps

1. Launch gator against a gateway: OPENSHELL_WORKSPACE=<ws> ./scripts/agents/run.sh --agent gator --gateway <gateway> --image <gator image digest> --name gator-4744-watch --watch "<scoped task>".
2. Run openshell --gateway <gateway> logs gator-4744-watch -n 1000 | grep -E 'oaiusercontent|auto-approval'.

Environment

• OpenShell: gateway 0.1.6-dev.26+g229382e51; launcher and image from feat(agents): support Kubernetes Gators with reusable tooling images #4744 (payload_version: 13)
• OS: sandbox image linux/amd64; Codex CLI from the gator Dockerfile
• Runtime, deployment, or integration: Kubernetes compute driver on a managed cloud cluster; providers github-gator and codex-gator

Logs

[sandbox] HTTP:GET [INFO] ALLOWED GET https://chatgpt.com/backend-api/ps/plugins/list [policy:_provider_codex_gator engine:l7]
[sandbox] NET:REFUSE [MED] DENIED sdmntprsouthcentralus.oaiusercontent.com [reason:policy_dns_ineligible]
[sandbox] NET:OPEN [MED] DENIED …/codex-linux-x64/…/bin/codex(0) -> sdmntprsouthcentralus.oaiusercontent.com:443 [reason:transparent_tcp_policy_denied]
[sandbox] CONFIG:OBSERVATION [INFO] Policy DNS staged unapproved name sdmntprsouthcentralus.oaiusercontent.com synthetic=198.18.0.3 for TCP policy review
[gateway] [INFO ] Auto-approved chunk: no new prover findings
[gateway] [WARN ] auto-approval failed; chunk remains pending for human review
[gateway] [WARN ] auto-approval failed; chunk remains pending for human review
[sandbox] CONFIG:LOADED [INFO] Policy reloaded successfully
[sandbox] HTTP:GET [INFO] ALLOWED GET https://sdmntprsouthcentralus.oaiusercontent.com/…
[sandbox] NET:REFUSE [MED] DENIED sdmntprcentralus.oaiusercontent.com [reason:policy_dns_ineligible]