mtech-ai-local-runner

This candidate connects the installed, hash-pinned root policy observer to the existing employee-privileged Codex CLI adapter. The observer accepts only its fixed employee UID and runs only a fixed read-only machine-policy command; it never runs a model o