fix: bound codex supervisor diagnostics

scripts/code-queue-pr-preflight-contract-test.ts

@@ -176,7 +176,6 @@ function remoteControlPlaneResult(overrides: Partial<JsonRecord> = {}): JsonReco
       prCreateDryRun: null,
       limitations: [],
       risks: [],
-      runnerDisposition: "ready",
       recoveryHint: "Runner PR workflow has env-token coverage for the scheduler.",
       commands: {
         local: "bun scripts/cli.ts gh auth status --repo pikasTech/unidesk",
@@ -300,11 +299,11 @@ async function main(): Promise<void> {
         database: { port: 15432, containerPort: 5432 },
         providerIngress: { port: 18082, containerPort: 8081 },
       },
-      database: { user: "unidesk", password: "unidesk_dev_password", name: "unidesk", volume: "unidesk_pgdata_10gb", volumeSize: "15GB" },
+      database: { user: "unidesk", password: "<redacted-test-password>", name: "unidesk", volume: "unidesk_pgdata_10gb", volumeSize: "15GB" },
       providerGateway: {
         id: "main-server",
         name: "Main Server Provider",
-        token: "unidesk-dev-token-change-me",
+        token: "<redacted-test-token>",
         labels: { host: "main-server", role: "self-provider", docker: true },
         heartbeatIntervalMs: 15000,
         reconnectBaseMs: 1000,
@@ -316,7 +315,7 @@ async function main(): Promise<void> {
       microservices: [],
       paths: { stateDir: ".state", logsDir: "logs", docsReferenceDir: "docs/reference" },
       sshForwarding: { mode: "ws", keyDir: "/root/.ssh", host: "main-server", port: 22, user: "root" },
-      auth: { username: "admin", password: "Liang6516.", sessionSecret: "secret", sessionTtlSeconds: 86400 },
+      auth: { username: "admin", password: "<redacted-test-password>", sessionSecret: "<redacted-test-session-secret>", sessionTtlSeconds: 86400 },
     },
     coreFetch: (path) => {
       observedLocalPath = path;