Fix agent empty-response in prod: workdir mount, image freshness, error surfacing

- Pin codex@0.142.0 + opencode-ai@1.17.9 in the job image (was @latest,
  causing dev/prod drift)
- Worker now s the job image once per process so prod stops
  running a stale Codex
- Surface Codex error/turn.failed events instead of swallowing them, so the
  real failure reason is reported rather than 'no assistant response'
- Harden the Codex JSON parser to also handle the legacy msg-wrapped shape
- Fix the docker-in-docker workdir: bind-mount identical host:container path
  and set SPOON_AGENT_HOST_WORKDIR (named volume can't be mounted by sibling
  job containers)
- Add docs/compose.prod.yml as a documented reference deployment

docker/agent-job.Dockerfile

@@ -17,7 +17,7 @@ RUN apt-get update \
   && corepack enable \
   && corepack prepare pnpm@latest --activate \
   && corepack prepare yarn@stable --activate \
-  && npm install -g bun@1.3.10 opencode-ai@latest @openai/codex@latest \
+  && npm install -g bun@1.3.10 opencode-ai@1.17.9 @openai/codex@0.142.0 \
   && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /workspace