fix(codex): skip sockets in session home overlay

[rudironsoni]

Description

Prevent headroom wrap codex from failing when the active CODEX_HOME contains a Unix socket. The session overlay copied every entry with shutil.copytree(), which raises shutil.Error when it reaches Git's fsmonitor--daemon.ipc socket.

The overlay now skips socket entries while continuing to copy regular Codex state and surface unrelated copy errors.

Closes #2103

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Performance improvement
• Code refactoring (no functional changes)

Changes Made

• Ignore filesystem sockets while seeding the temporary Codex session home.
• Add a regression test with a real nested fsmonitor--daemon.ipc socket and a regular sibling file.

Testing

• Focused unit tests pass (pytest tests/test_cli/test_wrap_codex.py -q)
• Linting passes (ruff check .)
• Type checking passes (mypy headroom)
• New regression test added
• Manual interactive testing performed

Test Output

Docker, Linux arm64, Python 3.12.12

pytest tests/test_cli/test_wrap_codex.py -q
88 passed in 5.92s

ruff check .
All checks passed!

ruff format --check .
1191 files already formatted

mypy headroom --ignore-missing-imports
Success: no issues found in 469 source files

Real Behavior Proof

• Environment: isolated Docker container on Linux arm64 with Python 3.12.12 and Rust 1.95.0
• Exact command / steps: bind a real Unix socket at vendor_imports/skills/.git/fsmonitor--daemon.ipc, then enter _codex_session_home_overlay() through the focused pytest regression
• Observed result: the regular sibling file is copied, the socket is omitted, the source socket remains active, and the overlay exits cleanly
• Not tested: an interactive Codex launch against the live host ~/.codex

Review Readiness

• I have performed a self-review
• This PR is ready for human review

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my code
• My changes generate no new warnings
• I have added tests that prove the fix is effective
• New and existing focused Codex wrapper tests pass with my changes

Additional Notes

The filter is intentionally limited to socket entries. Permission errors and failures involving regular files still propagate from shutil.copytree().

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

PR governance

This PR follows the template and is marked ready for human review.