I1: run paid eval containers with seccomp unconfined so Codex's sandbox can start

Docker's default seccomp profile blocks the user namespaces bubblewrap needs,
so every Codex command in a paid eval failed with 'bwrap: No permissions to
create a new namespace' (codex-review-findings, run 37151477069). Reproduced
in the CI image locally: default profile fails, seccomp=unconfined runs the
command. The runner stays non-root.

.github/workflows/evals-marathon.yml

@@ -129,7 +129,9 @@ jobs:
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
-      options: --user runner
+      # Docker's default seccomp profile blocks the user namespaces Codex's
+      # bubblewrap sandbox needs; without them every Codex command fails.
+      options: --user runner --security-opt seccomp=unconfined
     strategy:
       fail-fast: false
       max-parallel: 8

.github/workflows/evals-periodic.yml

@@ -161,7 +161,9 @@ jobs:
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
-      options: --user runner
+      # Docker's default seccomp profile blocks the user namespaces Codex's
+      # bubblewrap sandbox needs; without them every Codex command fails.
+      options: --user runner --security-opt seccomp=unconfined
     strategy:
       fail-fast: false
       # Every planned slice starts at once; test/evals-workflow-wiring.test.ts
@@ -299,7 +301,9 @@ jobs:
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
-      options: --user runner
+      # Docker's default seccomp profile blocks the user namespaces Codex's
+      # bubblewrap sandbox needs; without them every Codex command fails.
+      options: --user runner --security-opt seccomp=unconfined
     strategy:
       # Two file workers per slice, each retaining two in-file case workers.
       fail-fast: false

.github/workflows/evals.yml

@@ -222,7 +222,9 @@ jobs:
       credentials:
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
-      options: --user runner
+      # Docker's default seccomp profile blocks the user namespaces Codex's
+      # bubblewrap sandbox needs; without them every Codex command fails.
+      options: --user runner --security-opt seccomp=unconfined
     strategy:
       fail-fast: false
       max-parallel: 16