Milestone 6 of the Ollama-Codex Plan.

Sessions are namespace-confined via bwrap but currently have no hard resource limits: a single session can grow to tens of gigabytes on disk, run multi-hour builds at full CPU, and consume unbounded memory, stressing the host. This milestone closes that gap in two complementary halves: (A) impose per-session resource bounds (disk quota, CPU, memory) inside the bwrap sandbox so a runaway session cannot destabilise the host, and (B) automatically reclaim disk from sessions that have closed or become unbound, so completed work does not linger indefinitely.

Done when: (A) sessions spawn with cgroup/bwrap resource limits enforced; a session that hits quota is stopped cleanly rather than growing without bound. (B) the task-worker daemon runs a periodic sweep that removes eligible closed/unbound checkouts after a safety grace period, with dry-run logging and a disk-pressure escalation path.

Priority: LOW — correctness and feature work take precedence; address when resource contention is observed or as a background infrastructure task.

OCX-PLAN: role=milestone parent=be4a53983a8a393f11606bb4448f6a3422b422df seq=6