macOS code_sign_clone directories leak ~1GB per launch, never cleaned up

Bug description

Every time Codex launches on macOS, the system's codesign tool creates a temporary clone of the entire .app bundle under /private/var/folders/.../X/com.openai.codex.code_sign_clone/ with a random suffix (e.g., code_sign_clone.fk1vAZ). Each clone is ~1GB.

These directories are never cleaned up. After a few days of regular use, I had 35 stale clones consuming 35GB of disk space.

Steps to reproduce

1. Launch Codex on macOS
2. Check ls /private/var/folders/*/X/com.openai.codex.code_sign_clone/
3. Observe a new \code_sign_clone.XXXXXX` directory is created each launch
4. Previous directories are never removed

Expected behavior

Old code_sign_clone directories should be cleaned up on exit or at startup (before creating a new one).

Environment

• macOS (Apple Silicon)
• Codex desktop app

Workaround

Manual cleanup: rm -rf /private/var/folders/*/X/com.openai.codex.code_sign_clone/code_sign_clone.* (keep the newest one if Codex is running).

Note

Chrome has the same issue with com.google.Chrome.code_sign_clone, so this may be a Chromium/Electron-level behavior. If so, consider adding a startup cleanup hook to remove stale clones from previous sessions.