refactor: make bubblewrap the default Linux sandbox (#13996)

## Summary
- make bubblewrap the default Linux sandbox and keep
`use_legacy_landlock` as the only override
- remove `use_linux_sandbox_bwrap` from feature, config, schema, and
docs surfaces
- update Linux sandbox selection, CLI/config plumbing, and related
tests/docs to match the new default
- fold in the follow-up CI fixes for request-permissions responses and
Linux read-only sandbox error text

codex-rs/linux-sandbox/tests/suite/managed_proxy.rs

@@ -133,7 +133,6 @@ async fn run_linux_sandbox_direct(
         cwd.to_string_lossy().to_string(),
         "--sandbox-policy".to_string(),
         policy_json,
-        "--use-bwrap-sandbox".to_string(),
     ];
     if allow_network_for_proxy {
         args.push("--allow-network-for-proxy".to_string());