I1: run paid eval containers with seccomp unconfined so Codex's sandbox can start

Docker's default seccomp profile blocks the user namespaces bubblewrap needs,
so every Codex command in a paid eval failed with 'bwrap: No permissions to
create a new namespace' (codex-review-findings, run 37151477069). Reproduced
in the CI image locally: default profile fails, seccomp=unconfined runs the
command. The runner stays non-root.

.github/workflows/evals-marathon.yml

@@ -129,7 +129,9 @@ jobs:
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
-      options: --user runner
+      # Docker's default seccomp profile blocks the user namespaces Codex's
+      # bubblewrap sandbox needs; without them every Codex command fails.
+      options: --user runner --security-opt seccomp=unconfined
     strategy:
       fail-fast: false
       max-parallel: 8

.github/workflows/evals-periodic.yml

@@ -161,7 +161,9 @@ jobs:
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
-      options: --user runner
+      # Docker's default seccomp profile blocks the user namespaces Codex's
+      # bubblewrap sandbox needs; without them every Codex command fails.
+      options: --user runner --security-opt seccomp=unconfined
     strategy:
       fail-fast: false
       # Every planned slice starts at once; test/evals-workflow-wiring.test.ts
@@ -299,7 +301,9 @@ jobs:
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
-      options: --user runner
+      # Docker's default seccomp profile blocks the user namespaces Codex's
+      # bubblewrap sandbox needs; without them every Codex command fails.
+      options: --user runner --security-opt seccomp=unconfined
     strategy:
       # Two file workers per slice, each retaining two in-file case workers.
       fail-fast: false

.github/workflows/evals.yml

@@ -222,7 +222,9 @@ jobs:
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
-      options: --user runner
+      # Docker's default seccomp profile blocks the user namespaces Codex's
+      # bubblewrap sandbox needs; without them every Codex command fails.
+      options: --user runner --security-opt seccomp=unconfined
     strategy:
       fail-fast: false
       max-parallel: 16

test/ci-native-evidence.test.ts

@@ -27,7 +27,8 @@ test('every direct CI paid executor binds a safe unique run/attempt/job/slice id
   ]);
   const ids = new Set<string>();
   for (const [workflowIndex, { job, step }] of executors.entries()) {
-    expect(job.container.options).toBe('--user runner');
+    // Non-root, and Codex's bubblewrap sandbox can create user namespaces (periodic run 37151477069).
+    expect(job.container.options).toBe('--user runner --security-opt seccomp=unconfined');
     const env = { ...job.env, ...step.env };
     expect(env.EVALS_RUN_ID).toBeString();
     for (const run of ['36302678692', '36302678693']) {