Try to fix workers and workspace

AGENTS.md

@@ -20,7 +20,9 @@
   `spoon-agent-job` images to `git.gbrown.org/gib`. In production,
   `SPOON_AGENT_JOB_IMAGE` should point to
   `git.gbrown.org/gib/spoon-agent-job:latest`, and the worker service requires
-  access to the host Docker socket.
+  access to the host Docker socket. API-key provider jobs run through OpenCode;
+  Codex ChatGPT login profiles run through the Codex CLI with an injected
+  `CODEX_HOME/.codex/auth.json` inside the isolated job workspace.
 
 ## Protected and generated files