fix: share host ssh with codex queue

Mount the host root SSH directory into codex-queue read-only and include SSH key readiness in dev-ready health checks and docs.

src/components/microservices/codex-queue/src/index.ts

@@ -493,7 +493,10 @@ function collectDevReady(): JsonValue {
   const workdirExists = existsSync(config.defaultWorkdir);
   const dockerSocketExists = existsSync("/var/run/docker.sock");
   const codexConfigReady = existsSync(config.sourceCodexConfig) || existsSync(resolve(config.codexHome, "config.toml"));
-  const ok = missingTools.length === 0 && dockerProbe.ok && composeProbe.ok && workdirExists && dockerSocketExists && codexConfigReady;
+  const sshKeyProbe = runProbe("sh", ["-lc", "test -d /root/.ssh && find /root/.ssh -maxdepth 1 -type f \\( -name 'id_*' ! -name '*.pub' \\) -perm -400 -print -quit"]);
+  const githubKnownHostProbe = runProbe("ssh-keygen", ["-F", "github.com", "-f", "/root/.ssh/known_hosts"]);
+  const sshSharedReady = existsSync("/root/.ssh") && sshKeyProbe.ok && sshKeyProbe.output.trim().length > 0;
+  const ok = missingTools.length === 0 && dockerProbe.ok && composeProbe.ok && workdirExists && dockerSocketExists && codexConfigReady && sshSharedReady;
   const value: JsonValue = {
     ok,
     missingTools,
@@ -514,6 +517,13 @@ function collectDevReady(): JsonValue {
       homeConfigExists: existsSync(resolve(config.codexHome, "config.toml")),
       ready: codexConfigReady,
     },
+    ssh: {
+      rootSshPath: "/root/.ssh",
+      rootSshExists: existsSync("/root/.ssh"),
+      privateKeyPresent: sshSharedReady,
+      githubKnownHostPresent: githubKnownHostProbe.ok,
+      ready: sshSharedReady,
+    },
   };
   devReadyCache = { checkedAtMs: now, value };
   return value;