Fix live E2E worker isolation and SSH paths

#### Context

Live E2E could fail on cold Codex startup, remote `~/` workspace expansion, or Docker nested sandboxing.

#### TL;DR

*Make local and SSH live smoke tests reliable with test-only Codex isolation.*

#### Summary

- Fix remote `~/` workspace expansion so SSH workers use the intended home path.
- Run local live tests with an auth-only temporary `CODEX_HOME` and a 60s startup timeout.
- Use full access only inside disposable Docker SSH workers and finalize projects on failures.

#### Alternatives

- Did not change production Codex timeout defaults; the 60s budget is test-only.
- Did not make Docker privileged; the container remains the isolation boundary.

#### Test Plan

- [x] `make -C elixir all`
- [x] `cd elixir && CODEX_HOME=<temporary auth-only home> make e2e`