Merge branch 'codex/claude-runner-default' into codex/claude-runner-platforms

* codex/claude-runner-default:
  docs: retain cloud attestation context failure and correction
  fix(build): retain Pi v24 attestation in Docker context

.dockerignore

@@ -55,6 +55,7 @@ packages/paperclip-runner/test-fixtures/pi-acp/**
 !packages/paperclip-runner/test-fixtures/pi-acp/profile-v21-identity.json
 !packages/paperclip-runner/test-fixtures/pi-acp/profile-v22-identity.json
 !packages/paperclip-runner/test-fixtures/pi-acp/profile-v23-identity.json
+!packages/paperclip-runner/test-fixtures/pi-acp/profile-v24-identity.json
 !packages/paperclip-runner/docs/capability-contract.md
 # check:runner-workflow-traceability access()es every regression test the
 # stress-traceability spec names — those are src/**/*.test.ts files, so

doc/plans/2026-10-12-claude-runner-default.md

@@ -578,3 +578,10 @@ candidate source through the existing provider-free cloud workflow, with tooling
 and product identities recorded separately. No publication, deployment or paid
 retry is part of that campaign. The actual foundation code-owner approval and
 master reconciliation remain external prerequisites for normal merge sequencing.
+
+The first corrected candidate's cloud Docker-context check independently found
+profile 24 excluded by the existing explicit attestation allowlist. The new
+fixture now has its own exception alongside immutable prior identities; other
+fixtures remain excluded. Cloud job 115053600515 retained the exact ENOENT
+failure. No local Docker invocation was used. The next composed heads must pass
+this check before candidate package qualification.