S00-028: Record blocked task and remediation handoff

Changes: Preserve incomplete work and blocker metadata for S00-028. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-028 cannot independently validate project filesystem sandbox: installed Codex sandbox exits before command execution because the app-server socket directory must be user-owned with mode 0700. Host socket repair is outside launcher arguments scope.
Automatic blocker limit reached; explicit external resolution required.

Task: S00-028
Agent: auto-ci-cd-211cf3a2bd08
Role: ci-cd
Action: claim
Status: blocked

Task title: Repair conflicting Codex harness sandbox arguments

state/blockers/S00-030.md

@@ -0,0 +1,23 @@
+# Blocker S00-030
+
+- Original task: S00-028
+- Root task: S00-005
+- Reporter: auto-ci-cd-211cf3a2bd08
+- Role: ci-cd
+- Original owner: auto-ci-cd-211cf3a2bd08
+- Waits for user/external condition: True
+
+## Cause
+
+S00-028 cannot independently validate project filesystem sandbox: installed Codex sandbox exits before command execution because the app-server socket directory must be user-owned with mode 0700. Host socket repair is outside launcher arguments scope.
+Automatic blocker limit reached; explicit external resolution required.
+
+## One remediation outcome
+
+Coordinator provides a valid private app-server socket environment and a bounded no-model Codex sandbox probe executes with project write restrictions intact.
+
+## Evidence / reproduction
+
+codex -c 'sandbox_mode="workspace-write"' -c sandbox_workspace_write.network_access=true sandbox -- python3 -c '<synthetic project write/read/remove probe>' exits 1: error building bubblewrap command: app-server socket directory must be a user-owned directory with mode 0700. See state/evidence/S00-028-auto-ci-cd-211cf3a2bd08.md.
+
+The reporting agent must stop now. A new agent implements only S00-030.