fix(bootstrap): self-heal the free-Codex config block (ENG-4785)

[LarsenCundric]

Why

Staging TG threw "config profile browser-use-free not found". Root cause: bootstrap's guard appended the browser-use-free blocks only when the provider header was absent, so a box with a partial or outdated config was never repaired:

• missing [profiles.browser-use-free] table → "profile not found"
• stale wire_api = "chat" (pre-fix(agent): make free Codex usable end-to-end (ENG-4785) #265) → Codex config load error

This is the self-heal fix that was stranded off #266's merge (GitHub merged a stale PR head and dropped the commit). Re-landing it on its own branch.

Fix

Bootstrap now strips every existing browser-use-free table (provider, .auth, profile) and re-appends fresh ones on every run, so an outdated box self-heals on the next /update — no manual ~/.codex/config.toml deletion. Implemented as a python3 heredoc (run as the bux user) instead of awk-inside-bash -c to avoid a nested-quote minefield; CP_BASE passed via env. Preserves other tables ([features] goals) and the top-level profile selector.

Tested

• Stale chat config → heals to a valid single-block responses config (tomllib-parsed).
• Fresh box (no file) and idempotent (run-twice → one block each) verified.
• bash -n clean; CI shellcheck unaffected (the python lives in a heredoc).

Impact

Removes the manual "delete the config before re-bootstrapping" step — the current staging box (stale wire_api="chat") will self-repair on /update.

---

Summary by cubic

Make bootstrap self-heal the free Codex config by rewriting the browser-use-free provider and profile on every run. Fixes staging errors like "profile browser-use-free not found" and the legacy wire_api="chat" issue (ENG-4785).

• Bug Fixes
  • Strip existing browser-use-free tables (provider, .auth, profile) and append fresh ones each bootstrap; preserve other tables and the top-level profile.
  • Replace the awk-in-bash logic with a python3 heredoc run as bux; pass CP_BASE via env; set file mode to 0644.
  • Idempotent and heals stale configs to wire_api = "responses"; no manual ~/.codex/config.toml deletion needed.

^{Written for commit 7a051d1. Summary will update on new commits. Review in cubic}

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}