Enforce workspace metadata protections in Linux sandbox

[evawong-oai]

Summary

Enforce FileSystemSandboxPolicy protected metadata names in the Linux bubblewrap adapter so .git, .agents, and .codex remain read only inside writable workspace roots unless the policy grants an explicit write carveout.

Scope

1. Translate protected metadata names from FileSystemSandboxPolicy into bubblewrap masks for existing metadata paths.
2. Represent missing protected metadata paths as guarded mount targets so agents cannot create .git, .agents, or .codex under writable roots.
3. Preserve normal git discovery for existing repos, worktrees, and parent repos.
4. Keep explicit user write grants working when policy allows a protected metadata path directly.

Not in scope

1. No shell preflight UX.
2. No TUI runtime profile propagation.
3. No macOS Seatbelt changes in this PR.

Reviewer focus

1. This should be reviewed as the Linux enforcement adapter for the policy primitive from PR 19846.
2. macOS enforcement already landed in PR 19847.
3. The important invariant is that FileSystemSandboxPolicy is the source of truth for .git, .agents, and .codex.

Validation

1. git diff whitespace check passed.
2. cargo fmt check passed with the existing stable rustfmt warning about imports_granularity.
3. Full Linux sandbox Cargo test suite passed on the devbox.
4. Devbox forty six case suite passed at head 012accb703c13bd28df5b40079a9bf183036336a.
5. Devbox summary: pass 46, fail 0.
6. The devbox suite was run through just c sandbox linux.
7. Focused repo test for Viyat parent repo case passed on the devbox.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ca4b5c6387

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[evawong-oai]

Thanks. I am keeping this PR scoped to the Linux sandbox protection fix. A follow up cleanup PR will modularize the bwrap code so this logic is easier to review and maintain.