guard reviews against issue rediscovery

Dockerfile

@@ -1,3 +1,5 @@
+ARG TEA_VERSION=0.14.2
+
 FROM node:24-bookworm-slim AS codex
 
 ARG CODEX_VERSION=0.144.6
@@ -8,6 +10,8 @@ RUN npm install --global \
 
 FROM ghcr.io/astral-sh/uv:0.8.14 AS uv
 
+FROM gitea/tea:${TEA_VERSION} AS tea
+
 FROM python:3.13-slim-bookworm
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
@@ -16,15 +20,18 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
     UV_NO_DEV=1 \
     CODEGRAPH_TELEMETRY=0 \
     CODEX_HOME=/var/lib/codex \
+    XDG_CONFIG_HOME=/run/agentci \
     PATH=/opt/agentci/.venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 
 RUN apt-get update \
     && apt-get install --yes --no-install-recommends adduser ca-certificates git libstdc++6 \
     && rm -rf /var/lib/apt/lists/* \
     && /usr/sbin/adduser --disabled-password --gecos "" --uid 10001 agentci \
-    && mkdir -p /opt/agentci /var/lib/agentci /var/lib/codex /etc/codex
+    && mkdir -p /opt/agentci /var/lib/agentci /var/lib/codex /etc/codex /run/agentci \
+    && chown agentci:agentci /run/agentci
 
 COPY --from=uv /uv /uvx /usr/local/bin/
+COPY --from=tea /bin/tea /usr/local/bin/tea
 COPY --from=codex /usr/local/bin/node /usr/local/bin/node
 COPY --from=codex /usr/local/lib/node_modules/@openai/codex /usr/local/lib/node_modules/@openai/codex
 COPY --from=codex /usr/local/lib/node_modules/@colbymchenry /usr/local/lib/node_modules/@colbymchenry
@@ -39,7 +46,9 @@ COPY scripts ./scripts
 COPY codex/config.toml /etc/codex/config.toml
 
 RUN chmod 0755 \
+        /opt/agentci/scripts/entrypoint.sh \
         /opt/agentci/scripts/gitea-askpass.sh \
+        /usr/local/bin/tea \
         /usr/local/bin/codex \
         /usr/local/bin/codegraph \
     && uv sync --frozen --no-dev \
@@ -51,4 +60,5 @@ EXPOSE 8080
 HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
   CMD ["python", "-c", "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/health/live')"]
 
+ENTRYPOINT ["/opt/agentci/scripts/entrypoint.sh"]
 CMD ["agentci"]