A sandboxed mode for Codex sessions #398

Spec #136 runs Codex sessions with --dangerously-bypass-approvals-and-sandbox (ADR 0012), so the worktree is the only boundary. On a machine where Codex's bubblewrap sandbox can run, a User config setting could run Codex sessions sandboxed instead: --sandbox workspace-write, with network turned on (sandbox_workspace_write.network_access=true), and --add-dir naming the repository's shared .git so commits and pushes can write objects.

Left out of #136 because it can't be verified on a stock Ubuntu machine. There, kernel.apparmor_restrict_unprivileged_userns = 1 stops bubblewrap from starting, and every sandboxed command fails. It also needs a live check first: does workspace-write let git write a worktree's .git paths, which Codex protects as read-only? See docs/research/codex-headless-harness.md (sections 3 and 8).

To decide in triage:

• whether to support it at all
• the setting's name and default
• the setup needed on the host (for example an AppArmor profile that lets bubblewrap use user namespaces)
• whether --approve-for-me (an automatic reviewer for escalations) belongs in the same setting