S00-028: Record blocked task and remediation handoff

Changes: Preserve incomplete work and blocker metadata for S00-028. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-028 cannot independently validate project filesystem sandbox: installed Codex sandbox exits before command execution because the app-server socket directory must be user-owned with mode 0700. Host socket repair is outside launcher arguments scope.
Automatic blocker limit reached; explicit external resolution required.

Task: S00-028
Agent: auto-ci-cd-211cf3a2bd08
Role: ci-cd
Action: claim
Status: blocked

Task title: Repair conflicting Codex harness sandbox arguments

planning/tasks.json

@@ -1560,7 +1560,8 @@
       "title": "Repair conflicting Codex harness sandbox arguments",
       "outcome": "A reviewed compatible runner argv starts a fresh harness with project write sandbox without the mutually exclusive argument error.",
       "depends_on": [
-        "S00-002"
+        "S00-002",
+        "S00-030"
       ],
       "requirements": [],
       "scope": [
@@ -1654,6 +1655,57 @@
       ],
       "context_budget_chars": 48000
     },
+    {
+      "id": "S00-030",
+      "stage": "S00",
+      "kind": "blocker",
+      "root_task": "S00-005",
+      "blocker_depth": 4,
+      "unblocks": [
+        "S00-028"
+      ],
+      "role": "ci-cd",
+      "reviewer_role": "qa",
+      "title": "Provide a valid Codex sandbox app-server socket directory",
+      "outcome": "Coordinator provides a valid private app-server socket environment and a bounded no-model Codex sandbox probe executes with project write restrictions intact.",
+      "depends_on": [
+        "S00-002"
+      ],
+      "requirements": [],
+      "scope": [
+        "docs/AUTOMATION.md"
+      ],
+      "inputs": [
+        "docs/WEB_PROFILE.md",
+        "docs/ARCHITECTURE.md",
+        "docs/CONTRACTS.md",
+        "docs/TESTING.md",
+        "roles/storage.md",
+        "docs/decisions/README.md",
+        "state/blockers/S00-023.md",
+        "state/blockers/S00-025.md",
+        "state/blockers/S00-028.md",
+        "state/blockers/S00-030.md"
+      ],
+      "spec_sections": [],
+      "ui_sections": [],
+      "steps": [
+        "Read S00-028 evidence and coordinate host socket environment ownership/mode correction without changing product files",
+        "Document the supplied supported host setup in docs/AUTOMATION.md",
+        "Run a bounded no-model project write/read/remove and filesystem restriction diagnostic",
+        "Record evidence and submit for independent QA"
+      ],
+      "acceptance": [
+        "Codex sandbox no longer fails with the socket directory ownership/mode error",
+        "Project write sandbox remains enforced without bypass or broader writable roots",
+        "No storage task or additional model is executed"
+      ],
+      "checks": [
+        "Bounded codex sandbox diagnostic executes a synthetic project write/read/remove probe",
+        "Verify effective filesystem restrictions and record exact exit codes"
+      ],
+      "context_budget_chars": 48000
+    },
     {
       "id": "S00-010",
       "stage": "S00",