refactor: make bubblewrap the default Linux sandbox (#13996)

## Summary
- make bubblewrap the default Linux sandbox and keep
`use_legacy_landlock` as the only override
- remove `use_linux_sandbox_bwrap` from feature, config, schema, and
docs surfaces
- update Linux sandbox selection, CLI/config plumbing, and related
tests/docs to match the new default
- fold in the follow-up CI fixes for request-permissions responses and
Linux read-only sandbox error text

codex-rs/cli/src/debug_sandbox.rs

@@ -250,19 +250,18 @@ async fn run_command_under_sandbox(
             .await?
         }
         SandboxType::Landlock => {
-            use codex_core::features::Feature;
             #[expect(clippy::expect_used)]
             let codex_linux_sandbox_exe = config
                 .codex_linux_sandbox_exe
                 .expect("codex-linux-sandbox executable not found");
-            let use_bwrap_sandbox = config.features.enabled(Feature::UseLinuxSandboxBwrap);
+            let use_legacy_landlock = config.features.use_legacy_landlock();
             spawn_command_under_linux_sandbox(
                 codex_linux_sandbox_exe,
                 command,
                 cwd,
                 config.permissions.sandbox_policy.get(),
                 sandbox_policy_cwd.as_path(),
-                use_bwrap_sandbox,
+                use_legacy_landlock,
                 stdio_policy,
                 network.as_ref(),
                 env,