Enforce isolated repository evaluation

[chriswu727]

What changed

• add --require-isolation container|kubernetes to the repository matrix and bind it into checkpoints
• fail the primary evaluation gate if any full-Loop cell reports a different or missing isolation backend
• fail the gate for missing, unreported, or mixed model identity
• add a disposable Docker-required full-Loop matrix launcher and Make target
• document the exact Gate 4 workflow without changing the frozen DeepSeek result

Why

The existing reports recorded isolation but did not require it. A misconfigured run could silently downgrade to inline and still pass the release gate. Model fallback could also mix identities while the headline gate remained green.

Validation

• Python: ruff, format, mypy, 547 tests
• Web: lint, typecheck, 19 tests, production build
• Desktop: lint, typecheck, 14 tests, production build
• shellcheck and bash -n for the launcher
• live Docker sandbox command: exit 0 with expected container output
• launcher preflight: refuses before model invocation when no provider is configured
• pnpm and Python production dependency audits: no known vulnerabilities

A paid real-provider Docker matrix was not run because no provider credential is present in the environment; the frozen 95.24% report remains unchanged.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2fbb6db3e1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Gate on every executor model, not just the final one

When this new gate is meant to reject mixed-model fallbacks, same_model_across_modes only reflects each result’s collapsed model value. Full-loop receipts already carry provenance.executor_models, but _full_loop reduces them to provenance.model; if an early successful call uses a fallback provider and a later call succeeds on the primary again, the cell can report the primary as its final model and this gate still passes despite a mixed-model run. The gate should validate all executor identities recorded for each full-loop receipt, not just the final/collapsed identity.

Useful? React with 👍 / 👎.