fix(tokenless): add missing _common.sh to RPM spec

[Forrest-ly]

Summary

_common.sh is sourced by the Codex install.sh script but was never installed into the RPM buildroot or listed in %files. This causes install.sh to fail at runtime with "No such file or directory" after installing the tokenless RPM.

Add the helper to both the %install section (with 0644 permissions) and the %files section so it is packaged alongside the other Codex lifecycle scripts.

Closes #2420.

Risk and compatibility

• Packaging-only change; no runtime code changes.
• Permissions (0644) match the file's read-only helper nature.

Validation

• Verified src/tokenless/adapters/tokenless/codex/scripts/_common.sh exists in the source tree.
• bash scripts/rpm-build.sh tokenless succeeds locally and produces an RPM containing _common.sh.

[qoderai]

本次审查范围内未发现需要修改的问题。

---

🤖 Generated by Qoder • View workflow run

[ikunkun-sys]

The packaging change itself looks correct. I independently built the Tokenless RPM on Alibaba Cloud Linux 3 x86_64 and verified that _common.sh is included as root:root 0644, while install.sh and uninstall.sh remain executable. The extracted helper can also be sourced successfully.

One non-blocking process issue remains:

[P2] The standalone fix commit does not include the required Fixes: attribution. Both _common.sh and the corresponding source statements were introduced by 9ca77820, which is already on main. Per AGENTS.md §13, the commit body should identify that originating commit before merge.

[Forrest-ly]

@ikunkun-sys 感谢 review！已按意见处理 [P2] 缺 Fixes: 溯源的问题：

• 已将 fix commit amend，在 body 中补充 Fixes: 9ca77820 ("fix(tokenless): harden env-fix, version extraction, file trust, schema, permissions")（该 commit 引入了 _common.sh 及对应的 source 语句），符合 AGENTS.md §13 的 fix attribution 规则
• 仅改 commit message，无任何代码变更（与原 commit 的 diff 为空）
• 已 force-push，新 head：7313b4cb

麻烦再帮忙看一眼，谢谢！

[ikunkun-sys]

The code and RPM packaging change remain correct, and the previous missing-Fixes: finding has been addressed. The new and previously reviewed commits have identical trees.

One non-blocking commit-message issue remains:

[P2] The wrapped Fixes: trailer now contains a literal backslash. On 4338c9ee, git interpret-trailers --parse produces schema, \\ permissions, so the quoted subject no longer matches the actual subject of 9ca77820. Please wrap the trailer using a normal continuation line without a shell-style backslash. Commit Message Lint passes on this revision, but the attribution text itself is inaccurate.

[ikunkun-sys]

Requesting changes for the outstanding commit-attribution issue noted in the latest review.

The wrapped Fixes: trailer contains a literal backslash, so its quoted subject does not match the actual subject of 9ca77820. Please use a normal continuation line without a shell-style backslash. The code and RPM packaging change itself remains verified and otherwise looks correct.

[Forrest-ly]

@ikunkun-sys Thanks for catching the backslash issue in the Fixes: trailer. Fixed by putting the full quoted subject on a single line, removing the shell-style continuation entirely. git interpret-trailers --parse now correctly produces:

Fixes: 9ca77820 ("fix(tokenless): harden env-fix, version extraction, file trust, schema, permissions")

New head: 865d4b67 (force-pushed). Only the commit message changed — tree is identical to the previous revision.

[ikunkun-sys]

Requesting changes on the latest revision because the commit attribution is still malformed.

On 184f74c5, the Fixes: trailer again contains a literal backslash. git interpret-trailers --parse returns schema, \\ permissions, which does not match the actual subject of 9ca77820. The single-line form fixes the trailer value but fails the 100-character commit-message limit.

Please use Git's normal indented trailer continuation, without a backslash:

Fixes: 9ca77820 ("fix(tokenless): harden env-fix, version extraction, file trust,
 schema, permissions")

This form was locally verified to parse back to the exact original subject, and both physical lines are under 100 characters. The code tree remains identical to the previously verified RPM packaging change.