fix(codex): skip empty native-profile stage sweeps

[Ingwannu]

Summary

• Skip native-profile stage sweeping only when both the stage registry and this instance's staging tree are proven absent, so zero-profile installations do not contend on the profile transaction database or fence native-main traffic.
• Preserve the existing locked, fail-closed sweep whenever an artifact exists or its absence cannot be proven.
• Identify the resulting 503 as local OpenCodex native-profile maintenance and document the decision and invariants.

Closes #1120

Verification

• env -u OPENCODEX_API_AUTH_TOKEN taskset -c 0-1 bun test tests/native-profile-stage-lifecycle.test.ts tests/native-profile-drain-server.test.ts tests/codex-auth-context.test.ts — 51 pass, 0 fail.
• taskset -c 0-1 bun run typecheck — passed.
• taskset -c 0-1 bun run privacy:scan — passed.
• git diff --check — passed.
• Full suite: 9,417 pass, 10 skip, with one existing load-sensitive failure in Live/Realtime sideband retains main ownership while Direct and non-main Pool continue. The failing case then passed seven consecutive isolated/focused executions.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 24160e9e-4f2f-45f5-b468-6ef61ed1e200

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

Thank you — this is landing as #1134 in the stacked campaign, with your authorship preserved (the commit on that branch is authored by you, cherry-picked, not rewritten).

The absence-only framing is what makes this safe on a credential path: the sweep is skipped only when both the stage registry and the staging tree are provably absent, and anything present-or-unreadable still enters the locked fail-closed cleanup. Your regression test pinning both directions is the part that earns the change — a fast path that only proved the happy case would not have been adoptable here.

Verified on the stack head: tests/native-profile-stage-lifecycle.test.ts, tests/codex-auth-context.test.ts, tests/native-profile-drain-server.test.ts — 51 pass / 0 fail; typecheck clean; privacy scan green; full suite passed the prepush gate.

Leaving this PR open for you to close or continue.