fix: scope codex-pool sentinel image to enabled targets

scripts/src/platform-infra-sub2api-codex/runtime-target.ts

@@ -41,11 +41,16 @@ export function readSub2ApiRuntimeConfig(): Sub2ApiRuntimeConfig {
   const secrets = runtime !== null && isRecord(runtime.secrets) ? runtime.secrets : null;
   const secretsRoot = secrets === null ? null : stringValue(secrets.root);
   if (secretsRoot === null || !secretsRoot.startsWith("/")) throw new Error(`${sub2apiConfigPath}.runtime.secrets.root must be an absolute path`);
+  const sentinel = runtime !== null && isRecord(runtime.sentinel) ? runtime.sentinel : null;
+  const enabledOnTargets = Array.isArray(sentinel?.enabledOnTargets)
+    ? sentinel.enabledOnTargets.map((entry) => stringValue(entry)).filter((entry): entry is string => entry !== null && entry.length > 0)
+    : [];
   if (!Array.isArray(parsed.targets) || !parsed.targets.every(isRecord)) throw new Error(`${sub2apiConfigPath}.targets must be a list`);
   return {
     defaultTargetId,
     appSecretName,
     secretsRoot,
+    sentinelEnabledOnTargets: enabledOnTargets,
     targets: parsed.targets,
   };
 }
@@ -100,6 +105,7 @@ export function codexPoolRuntimeTarget(targetId?: string): CodexPoolRuntimeTarge
     publicExposure,
     appSecretName: runtimeConfig.appSecretName,
     secretsRoot: runtimeConfig.secretsRoot,
+    sentinelEnabled: runtimeConfig.sentinelEnabledOnTargets.some((entry) => entry.toLowerCase() === id.toLowerCase()),
     sentinelImageBuild,
     egressProxy,
   };