linux-sandbox: honor split filesystem policies in bwrap (#13453)

## Why

After `#13449`, the Linux helper could receive split filesystem and
network policies, but the bubblewrap mount builder still reconstructed
filesystem access from the legacy `SandboxPolicy`.

That loses explicit unreadable carveouts under writable roots, and it
also mishandles `Root` read access paired with explicit deny carveouts.
In those cases bubblewrap could still expose paths that the split
filesystem policy intentionally blocked.

## What changed

- switched bubblewrap mount generation to consume
`FileSystemSandboxPolicy` directly at the implementation boundary;
legacy `SandboxPolicy` configs still flow through the existing
`FileSystemSandboxPolicy::from(&sandbox_policy)` bridge before reaching
bwrap
- kept the Linux helper and preflight path on the split filesystem
policy all the way into bwrap
- re-applied explicit unreadable carveouts after readable and writable
mounts so blocked subpaths still win under bubblewrap
- masked denied directories with `--tmpfs` plus `--remount-ro` and
denied files with `--ro-bind-data`, preserving the backing fd until exec
- added comments in the unreadable-root masking block to explain why the
mount order and directory/file split are intentional
- updated Linux helper call sites and tests for the split-policy bwrap
path

## Verification

- added protocol coverage for root carveouts staying scoped
- added core coverage that root-write plus deny carveouts still requires
a platform sandbox
- added bwrap unit coverage for reapplying blocked carveouts after
writable binds
- added Linux integration coverage for explicit split-policy carveouts
under bubblewrap
- validated the final branch state with `cargo test -p
codex-linux-sandbox`, `cargo clippy -p codex-linux-sandbox --all-targets
-- -D warnings`, and the PR CI reruns

---
[//]: # (BEGIN SAPLING FOOTER)
Stack created with [Sapling](https://sapling-scm.com). Best reviewed
with [ReviewStack](https://reviewstack.dev/openai/codex/pull/13453).
* __->__ #13453
* #13452
* #13451
* #13449
* #13448
* #13445
* #13440
* #13439

---------

Co-authored-by: viyatb-oai <viyatb@openai.com>

codex-rs/linux-sandbox/src/vendored_bwrap.rs

@@ -6,6 +6,7 @@
 #[cfg(vendored_bwrap_available)]
 mod imp {
     use std::ffi::CString;
+    use std::fs::File;
     use std::os::raw::c_char;
 
     unsafe extern "C" {
@@ -27,7 +28,10 @@ mod imp {
     ///
     /// On success, bubblewrap will `execve` into the target program and this
     /// function will never return. A return value therefore implies failure.
-    pub(crate) fn run_vendored_bwrap_main(argv: &[String]) -> libc::c_int {
+    pub(crate) fn run_vendored_bwrap_main(
+        argv: &[String],
+        _preserved_files: &[File],
+    ) -> libc::c_int {
         let cstrings = argv_to_cstrings(argv);
 
         let mut argv_ptrs: Vec<*const c_char> = cstrings.iter().map(|arg| arg.as_ptr()).collect();
@@ -39,16 +43,21 @@ mod imp {
     }
 
     /// Execute the build-time bubblewrap `main` function with the given argv.
-    pub(crate) fn exec_vendored_bwrap(argv: Vec<String>) -> ! {
-        let exit_code = run_vendored_bwrap_main(&argv);
+    pub(crate) fn exec_vendored_bwrap(argv: Vec<String>, preserved_files: Vec<File>) -> ! {
+        let exit_code = run_vendored_bwrap_main(&argv, &preserved_files);
         std::process::exit(exit_code);
     }
 }
 
 #[cfg(not(vendored_bwrap_available))]
 mod imp {
+    use std::fs::File;
+
     /// Panics with a clear error when the build-time bwrap path is not enabled.
-    pub(crate) fn run_vendored_bwrap_main(_argv: &[String]) -> libc::c_int {
+    pub(crate) fn run_vendored_bwrap_main(
+        _argv: &[String],
+        _preserved_files: &[File],
+    ) -> libc::c_int {
         panic!(
             r#"build-time bubblewrap is not available in this build.
 codex-linux-sandbox should always compile vendored bubblewrap on Linux targets.
@@ -60,8 +69,8 @@ Notes:
     }
 
     /// Panics with a clear error when the build-time bwrap path is not enabled.
-    pub(crate) fn exec_vendored_bwrap(_argv: Vec<String>) -> ! {
-        let _ = run_vendored_bwrap_main(&[]);
+    pub(crate) fn exec_vendored_bwrap(_argv: Vec<String>, _preserved_files: Vec<File>) -> ! {
+        let _ = run_vendored_bwrap_main(&[], &[]);
         unreachable!("run_vendored_bwrap_main should always panic in this configuration")
     }
 }