[zy95-12]

Written-by: Codex

Fixes #2398 on delivery/ai-centric-development-service.

A container could use a different Codex login cache while readiness still appeared reusable, and refresh-token failures were reduced to generic SDK errors. Bind existing setup/probe/worker readiness to the actual persistent profile, preserve safe authentication codes through the SDK worker into authRequired, and expose actual setup paths only to resource administrators. Configuration terminals resolve the resource SDK CLI so login uses the right program and CODEX_HOME.

No credential copies, OAuth broker, new recovery routing, sandbox changes or Task-role Session resets. Changed/legacy unbound readiness requires the existing check; candidates and Review evidence remain intact. Includes memory, architecture, README/operations, OpenAPI, regression tests and generated patches.

Validation at 55f8975c3d93f27ef242a6c9d859c7b0d68986eb:

• Meaningful auth regression fails against the original source and passes after the fix.
• Real PTY/profile/PATH, current/stale profile readiness, typed probe/host failures and non-auth error tests pass.
• Actual pinned Codex SDK/CLI worker passes locally and in Docker against an isolated HTTP401/refresh-token-reused fixture. No paid inference or real OAuth refresh performed.
• New helper coverage: 100% lines/functions, 95.92% branches; not a whole-change or 100% branch coverage claim. Optional profile/error shapes and real token rotation are not exhaustively covered.
• Full root npm run verify passes: 4,938 tests, zero failures; lint, generated patch consistency and OpenAPI validation also pass.

The live container login remains untouched. Expired/reused OAuth credentials still need a native login in the selected persistent profile after rollout; source merge does not perform login or deployment. Root policy budget and existing Session paths remain unchanged.

Pairing self-review covers correctness/security/conventions with no unresolved implementation blockers. Use the Owner-authorized basic CI / delivery-only merge scope; no independent forge PASS is fabricated.