Sync public mock environment fidelity

[bingran-you]

Summary

• Add public auth middleware/scope parity for mock-gcal, mock-gdrive, mock-gdoc, and mock-slack.
• Bring Gmail public runtime closer to private fidelity: auth-aware deps, web SSO handoff, multi-account seed support, label isolation, and RFC 2047/raw MIME regression tests.
• Add benchflow.env0.services metadata to every public benchmark task so the manifest can start only required mock services.
• Fix public task verifier imports/path setup so task tests run without private env-0 packages.
• Keep private-only /dev/tasks web viewer surfaces unpublished in the public repo while preserving CLI/manifest task execution.

Validation

• python3 -m unittest tests/test_env0_control.py
• ROOT=/Users/bingran_you/.codex/worktrees/e2b4/env-0-experiment/.local/audit-env0-vs-env-0-20260704/env0; PYTHONPATH=... uv run --extra dev python -m pytest "$ROOT"/tasks/*/verifier/test_*.py -q -> 379 passed
• cd packages/environments/mock-gmail && uv run --extra dev pytest tests -q -> 246 passed
• cd packages/environments/mock-gcal && uv run --extra dev pytest tests -q -> 140 passed
• cd packages/environments/mock-gdrive && uv run --extra dev pytest tests -q -> 321 passed, 2 skipped
• cd packages/environments/mock-gdoc && uv run --extra dev pytest tests -q -> 182 passed, 3 skipped
• cd packages/environments/mock-slack && uv run --extra dev pytest tests -q -> 335 passed, 4 skipped
• scripts/smoke_dev.sh
• docker/build-base.sh
• PULL_BASE=0 scripts/smoke_docker_examples.sh
• One-off Docker build + service health check for every tasks/*/environment/Dockerfile -> all task docker checks ok

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bf57ee206f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep legacy bot tokens targeting bot presence

When AUTH_ENABLED is unset, this branch is the legacy path; by hard-coding the first non-bot user it ignores the Authorization header that resolve_current_user_id used here before. For POST /api/users.setPresence with Authorization: Bearer mock-bot-token or any non-user xoxb-style token, the old code updated B01MOCKBOT, but this now updates the first human user, so legacy Slack token behavior is no longer byte-identical. Reuse resolve_current_user_id in the auth-disabled branch.

Useful? React with 👍 / 👎.