fix(docker): post-merge fixes for codex backend compatibility

- restore COPY harness/ (perso durante edit) -> /app/harness esiste
- cp workflow.yaml in site-packages: tht lo carica module-relative
  (parent.parent del package); non-editable install non lo includeva
  -> session show 500 (FileNotFoundError). pip install -e non accettato da pip.
- cd /app/harness && pip install . : pip 26.1.2 rifiuta il path bare /app/harness
- compose: THT_MODEL_API_KEY_FILE per buildPiChildEnv (codex) -> session create
  prima 500 'model provider credential is unavailable'
Verificato: session show 200 (phase 1), create 200, Pi+model+SSE OK.

compose.yaml

@@ -23,6 +23,7 @@ services:
       THT_BIN: /opt/venv/bin/tht
       SETTINGS_FILE: /data/settings/settings.json
       THT_CONFIG: /app/harness/workspaces/local.yaml   # configPath di default per i route tht senza workspace esplicito
+      THT_MODEL_API_KEY_FILE: /data/secrets/model_api_key   # provider key per buildPiChildEnv (codex)
       AUTH_MODE: ${AUTH_MODE:-none}
       MAX_PI_PROCESSES: ${MAX_PI_PROCESSES:-4}
     extra_hosts:

docker/core.Dockerfile

@@ -30,12 +30,17 @@ RUN ln -s /usr/local/lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
 # Utente non-root
 RUN useradd --create-home --uid 10001 --shell /bin/bash thoth
 
-# Harness: venv nativo (python 3.12) + tht installato NON editabile (nel venv, indipendente dal path sorgente).
-# psycopg2-binary è wheel → niente gcc/libpq-dev. yake/sqlglot/datasketch/pydantic hanno wheel per py3.12.
 COPY harness/ /app/harness/
+
+# Harness: venv nativo (python 3.12) + tht installato (non-editable).
+# tht carica workflow.yaml module-relative (Path(__file__).parent.parent); con il package
+# in site-packages quel path non contiene workflow.yaml -> lo copiamo dopo l'install.
+# (pip install -e non funziona: pip non riconosce /app/harness come editable req.)
+# psycopg2-binary è wheel → niente gcc/libpq-dev.
 RUN python -m venv /opt/venv \
     && /opt/venv/bin/pip install --no-cache-dir --upgrade pip \
-    && /opt/venv/bin/pip install --no-cache-dir /app/harness
+    && (cd /app/harness && /opt/venv/bin/pip install --no-cache-dir .) \
+    && cp /app/harness/workflow.yaml /opt/venv/lib/python3.12/site-packages/workflow.yaml
 # PiProcessManager (backend) prepende harnessDir/.venv/bin al PATH del child Pi → symlink al venv reale
 RUN ln -s /opt/venv /app/harness/.venv