Fix scoped-filesystem access-denied errors in codex builds

[Mpdreamz]

Why

The codex build command failed. It showed Access denied errors. It failed even when the file paths were correct. Two separate problems caused this.

What

Problem 1: the code threw away the wrong folder

The code builds a list of folders that a build may read or write. Some folders sit inside other folders. Old code kept only one folder in each pair and threw away the other one. The code always kept the inner (smaller) folder.

This was wrong in one case. A codex checkout can sit inside the app's data folder. In this case, the app's data folder is the correct folder to keep. The old code threw it away instead. This removed access to other files inside the app's data folder, like config-runtime. Those files were still needed.

The fix adds a new helper, AddDisjointRoot. It keeps the outer (bigger) folder, not the inner folder.

Problem 2: two writers used the wrong file system scope

A codex build makes one output folder per repository. This diagram shows the folder layout:

.artifacts/codex/docs/
├── r/
│   └── my-repo/              <- one repo's own folder: r/my-repo/
│       ├── index.html
│       └── config/
├── r/my-repo.md              <- LlmMarkdownExporter writes here, ONE LEVEL UP from my-repo/
├── _static/                  <- CodexGenerator writes here, at the TOP folder
├── index.html                <- CodexGenerator writes the home page here
└── redirects.json

Two parts of the code write files outside a single repo's own folder:

• LlmMarkdownExporter writes a file next to the repo folder, one level up.
• CodexGenerator writes shared files. Examples: the home page and the static assets folder. These files go in the top folder, not in one repo's folder.

Both parts used the file system scope for one repo's folder. This scope was too narrow. It did not cover the folder one level up, or the top folder. This caused the Access denied error.

The fix gives both parts the correct, wider file system scope. This scope covers the whole codex output tree. Other build types (isolated builds, assembler builds) do not use this wider scope. They keep their normal, narrower scope.

Small cleanup

One method, BuildDocumentationSet, was only used by codex builds. It lived in a shared file used by other build types too. The fix moves this method into the codex-specific file. This makes the code easier to read. It does not change behavior for other build types.

Test plan

• Build the project. Result: no errors.
• Run all unit tests. Result: all tests pass.
• Run the code format checker. Result: no problems found.
• Run a real codex build with several repos. Check the output files: sibling .md files, the _static folder, redirects.json, and index.html. Result: all files are in the correct place. No Access denied errors.