Enable approved tasks for protected agent Ping

[pirajoke]

Root cause

The authenticated Ping process invoked the approved-task runner while inheriting , so a valid PONG always ended in a generic failed status.

Fix

• opt into GitHub approved tasks only in the protected Ping child process
• preserve process-wide configuration, auth, exact role, and fixed task boundaries
• add a focused regression test

Evidence

• intentional RED: child env inherited 0 instead of 1
• GREEN: 163/163 builder tests pass
• Python compile, zsh syntax, and diff checks pass

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 04d5042692

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve the ping opt-in after loading the agent env

When $HOME/.secrets/jarvis-agent.env contains JARVIS_GITHUB_TASKS_ENABLED=0, the child receives this new value as 1 but jarvis-agent-pipeline subsequently sources that file at lines 6–12, resetting the exported variable to 0 before invoking jarvis.dashboard_agent_runner; approved tasks therefore remain disabled in this production configuration. The regression test only inspects the Popen arguments and never runs the pipeline with an env file, so it cannot detect the override; preserve or reapply the protected-ping opt-in after the file is sourced.

Useful? React with 👍 / 👎.