fix(docker): post-merge fixes for codex backend compatibility

- restore COPY harness/ (perso durante edit) -> /app/harness esiste
- cp workflow.yaml in site-packages: tht lo carica module-relative
  (parent.parent del package); non-editable install non lo includeva
  -> session show 500 (FileNotFoundError). pip install -e non accettato da pip.
- cd /app/harness && pip install . : pip 26.1.2 rifiuta il path bare /app/harness
- compose: THT_MODEL_API_KEY_FILE per buildPiChildEnv (codex) -> session create
  prima 500 'model provider credential is unavailable'
Verificato: session show 200 (phase 1), create 200, Pi+model+SSE OK.

compose.yaml

@@ -23,6 +23,7 @@ services:
       THT_BIN: /opt/venv/bin/tht
       SETTINGS_FILE: /data/settings/settings.json
       THT_CONFIG: /app/harness/workspaces/local.yaml   # configPath di default per i route tht senza workspace esplicito
+      THT_MODEL_API_KEY_FILE: /data/secrets/model_api_key   # provider key per buildPiChildEnv (codex)
       AUTH_MODE: ${AUTH_MODE:-none}
       MAX_PI_PROCESSES: ${MAX_PI_PROCESSES:-4}
     extra_hosts: