ci(verify): mirror upstream Linux nextest setup

Update the manual verify workflow to prepare the Linux runner for sandbox-heavy nextest coverage. Enable unprivileged user namespaces for bubblewrap-based tests, provision the Docker-backed remote test environment before nextest, and tear it down afterward so the manual job matches upstream Linux test prerequisites more closely.

Author: ignatremizov

.github/workflows/manual-verify.yml

@@ -86,6 +86,15 @@ jobs:
         with:
           tool: cargo-nextest
 
+      - name: Enable unprivileged user namespaces (Linux)
+        shell: bash
+        run: |
+          set -euo pipefail
+          sudo sysctl -w kernel.unprivileged_userns_clone=1
+          if sudo sysctl -a 2>/dev/null | grep -q '^kernel.apparmor_restrict_unprivileged_userns'; then
+            sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+          fi
+
       - name: Configure sccache
         shell: bash
         run: |
@@ -99,9 +108,26 @@ jobs:
       - name: cargo clippy --workspace --all-features --tests
         run: cargo clippy --workspace --all-features --tests --timings -- -D warnings
 
+      - name: Set up remote test env (Docker)
+        shell: bash
+        run: |
+          set -euo pipefail
+          export CODEX_TEST_REMOTE_ENV_CONTAINER_NAME=codex-remote-test-env
+          source "${GITHUB_WORKSPACE}/scripts/test-remote-env.sh"
+          echo "CODEX_TEST_REMOTE_ENV=${CODEX_TEST_REMOTE_ENV}" >> "$GITHUB_ENV"
+
       - name: cargo nextest run --all-features
         run: env -u CODEX_SANDBOX_NETWORK_DISABLED cargo nextest run --all-features --no-fail-fast --cargo-profile ci-test --timings
 
+      - name: Tear down remote test env
+        if: always()
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ -n "${CODEX_TEST_REMOTE_ENV:-}" ]]; then
+            docker rm -f "${CODEX_TEST_REMOTE_ENV}" >/dev/null 2>&1 || true
+          fi
+
       - name: Upload Cargo timings
         if: always()
         uses: actions/upload-artifact@v7