fix: flaky landlock (#10689)

https://openai.slack.com/archives/C095U48JNL9/p1770243347893959

codex-rs/app-server/tests/suite/v2/turn_start.rs

@@ -1716,11 +1716,12 @@ async fn command_execution_notifications_include_process_id() -> Result<()> {
     ];
     let server = create_mock_responses_server_sequence(responses).await;
     let codex_home = TempDir::new()?;
-    create_config_toml(
+    create_config_toml_with_sandbox(
         codex_home.path(),
         &server.uri(),
         "never",
         &BTreeMap::from([(Feature::UnifiedExec, true)]),
+        "danger-full-access",
     )?;
 
     let mut mcp = McpProcess::new(codex_home.path()).await?;
@@ -1847,6 +1848,22 @@ fn create_config_toml(
     server_uri: &str,
     approval_policy: &str,
     feature_flags: &BTreeMap<Feature, bool>,
+) -> std::io::Result<()> {
+    create_config_toml_with_sandbox(
+        codex_home,
+        server_uri,
+        approval_policy,
+        feature_flags,
+        "read-only",
+    )
+}
+
+fn create_config_toml_with_sandbox(
+    codex_home: &Path,
+    server_uri: &str,
+    approval_policy: &str,
+    feature_flags: &BTreeMap<Feature, bool>,
+    sandbox_mode: &str,
 ) -> std::io::Result<()> {
     let mut features = BTreeMap::from([(Feature::RemoteModels, false)]);
     for (feature, enabled) in feature_flags {
@@ -1871,7 +1888,7 @@ fn create_config_toml(
             r#"
 model = "mock-model"
 approval_policy = "{approval_policy}"
-sandbox_mode = "read-only"
+sandbox_mode = "{sandbox_mode}"
 
 model_provider = "mock_provider"