#1502 Feat/dock add codex

Summary by cubic

Add Codex to the macOS Dock and ship several hardening and UX improvements. Includes a new mempalace config, macOS support for decafinate, safer local service defaults, SSH-friendly clipboard copy, and reliable uv Python wrappers that fix module import errors.

• New Features

  • Added Codex.app to the macOS Dock (between ChatGPT and Claude).
  • Added mempalace home-manager module with config at ~/.mempalace/config.json.
  • Added macOS support for decafinate (uses caffeinate with PID-based control).

• Bug Fixes

  • uv-globals: switched to wrapper scripts and a PATH-based python3 dispatcher (removes stale symlinks); fixes “No module named mempalace” and avoids venv corruption.
  • Security: enabled Nix sandbox in the Dockerfile; bound ollama and paperclip to 127.0.0.1; limited ollama to laptops and disabled docker-postgres on Galactica/Matic; added secure-dotenv to enforce 600 perms on .env files.
  • Clipboard: added OSC 52 copy fallback for SSH-capable terminals and clearer paste error messaging.