fix(windows-sandbox): finish CI callsite updates

Co-authored-by: Codex noreply@openai.com

codex-rs/cli/src/debug_sandbox.rs

@@ -389,6 +389,8 @@ async fn run_command_under_windows_session(
             cwd.as_path(),
             env,
             None,
+            /*additional_deny_read_paths*/ &[],
+            /*additional_deny_write_paths*/ &[],
             /*tty*/ false,
             /*stdin_open*/ true,
             config.permissions.windows_sandbox_private_desktop,

codex-rs/windows-sandbox-rs/src/spawn_prep.rs

@@ -214,6 +214,7 @@ pub(crate) fn allow_null_device_for_workspace_write(is_workspace_write: bool) {
     }
 }
 
+#[allow(clippy::too_many_arguments)]
 pub(crate) fn apply_legacy_session_acl_rules(
     policy: &SandboxPolicy,
     sandbox_policy_cwd: &Path,