[codex] Let machine fit override Podman default

[8Dionysus]

Summary

• Track whether AOA_PODMAN_CONTAINERS_ROOT was operator-provided before aoa-lib.sh computes its runtime-user fallback.
• Allow machine-fit validated_settings.AOA_PODMAN_CONTAINERS_ROOT to override only that computed default.
• Preserve explicit operator-provided Podman root values as stronger than machine-fit.

Why

Codex Review on PR #167 found that the computed default made AOA_PODMAN_CONTAINERS_ROOT look set before aoa_apply_machine_fit_runtime_posture, causing validated relocated rootless Podman storage roots to be silently ignored.

Validation

• failing-before-fix: python -m pytest -q tests/test_aoa_lib_env_compat.py -k 'podman_root' failed because the computed /home/dionysus/.local/share/containers default masked machine-fit
• python -m pytest -q tests/test_aoa_lib_env_compat.py -k 'podman_root'
• python -m pytest -q tests/test_profile_topology_validator_module.py -k 'podman_container'
• git diff --check
• python -m pytest -q tests/test_aoa_lib_env_compat.py tests/test_profile_topology_validator_module.py
• python scripts/validate_stack.py
• python scripts/validate_nested_agents.py
• python scripts/ci_gate.py --mode source-fast
• shellcheck scripts/aoa-lib.sh
• aoa checkpoint review-note /home/dionysus/src/abyss-stack --commit-ref 9820d8c108d635e3f50de3af3729d91aa9a026c3 --auto --root /srv/AbyssOS

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.