feat(zhulan): add guarded Codex Remote SSH lane

server-tools/zhulan-remote-cell/remote/LANE.hdlp

@@ -0,0 +1,25 @@
+zhulan_remote_lane:
+  schema: "guanghu.zhulan-codex-remote-lane/v1"
+  persona_id: "ICE-GL-ZL-001"
+  persona_name: "铸澜"
+  development_mode: "MOBILE_CODEX_REMOTE_OVER_DESKTOP_TO_SSH"
+  runtime_node: "BS-SG-003"
+  public_front_role: "BS-GZ-006_PROXY_ONLY"
+  human_approval_front: "https://guanghulab.com/zhulan/"
+  workspace_root: "/srv/guanghu/zhulan-codex/workspaces"
+  candidate_root: "/srv/guanghu/zhulan-codex/candidates"
+  central_repository_write_credentials: false
+  sudo: false
+  production_write: false
+  central_main_publish: false
+  required_cycle:
+    - "restore this lane and the newest server checkpoint"
+    - "work only in the selected repository under workspace_root"
+    - "run repository tests and git diff --check"
+    - "commit only to a zhulan/* branch"
+    - "push only to the server-local candidate remote"
+    - "leave a receipt for desktop Zhuyuan review and central publication"
+  fail_closed:
+    - "never read or modify /etc/guanghu, /var/lib/guanghu, /opt/guanghu, /root or the production runtime tree"
+    - "never use sudo, systemctl, service managers, SSH pivots or central repository push"
+    - "never treat a prompt, UI state or passing local test as human approval or central publication"