codex login binds its callback server to container loopback, so the host
browser redirect to localhost:1455 is refused. Publish 127.0.0.1:1455 on
the opt-in networked service only and bridge it to loopback with a small
node relay. Document the flow, fresh-state retry, and token lifetime in
the hardened-harness skill.
Follow-up to #2625.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>