[DanielNetzer]

Implements issue #401.

Molecule: mol-401-13d8cf86cfd1fcee8cd50533
Formula: forgecell-github-issue
Base: 5a4e0c89deaa46dc185ed9156b8f05b11f5d44e3
Delivery: 44e6de3d01103b1ca104a60c310d63ed5b6bf9dc

Awaiting exact-commit CI and human review. Harness-reported checks are not independent CI evidence. No merge, deployment or issue closure is authorized.

[DanielNetzer]

Protected regression: two tests failed by design and were accepted with --accept-protected-failures:

• TestAdapterInvocationChangesRequireProtocolBump: the old test has no pin for protocol 9.
• TestHarnessCacheReachesCodexCodingInvocation (from Give Codex coding runs a writable Lab-owned Go build cache (#43, slice 1) #396): the old version asserts the Codex argv differs only by --add-dir; Codex's shell_environment_policy drops the harness GOCACHE (#396 follow-up) #401 adds the two shell_environment_policy.set overrides, and the test is updated to assert them with exact quoting.

Manual check before the change: under codex sandbox (Codex 0.167.0), -c shell_environment_policy.set.GOCACHE=… overrode an inherited GOCACHE, and the Lab cache directory became writable through writable_roots. The real proof is the Codex retest on forgecell-trial after release.

Protocol 9: saved bindings need a reviewed rebind after upgrading. All checks passed.