refactor: make bubblewrap the default Linux sandbox (#13996)

## Summary
- make bubblewrap the default Linux sandbox and keep
`use_legacy_landlock` as the only override
- remove `use_linux_sandbox_bwrap` from feature, config, schema, and
docs surfaces
- update Linux sandbox selection, CLI/config plumbing, and related
tests/docs to match the new default
- fold in the follow-up CI fixes for request-permissions responses and
Linux read-only sandbox error text

codex-rs/cli/src/lib.rs

@@ -32,7 +32,7 @@ pub struct LandlockCommand {
     #[clap(skip)]
     pub config_overrides: CliConfigOverrides,
 
-    /// Full command args to run under landlock.
+    /// Full command args to run under the Linux sandbox.
     #[arg(trailing_var_arg = true)]
     pub command: Vec<String>,
 }