Add workspace metadata protection policy primitive

[evawong-oai]

Summary

Add a policy primitive for protected workspace metadata names so writable roots can reserve .git, .codex, and .agents before platform sandbox code consumes the policy.

Scope

1. Add protected_metadata_names to WritableRoot.
2. Default workspace writable roots to protect .git, .codex, and .agents.
3. Make runtime file system checks reject writes to protected metadata path names unless user policy explicitly allows them.
4. Add the Linux fallback initializer needed before Linux enforcement lands later in the stack.

Reviewer Focus

1. Metadata protection belongs in policy, not command parsing.
2. Explicit user write rules can still opt into these metadata paths.
3. Legacy workspace write behavior still protects existing git metadata and now also covers the missing metadata path case.

Stack

1. Policy primitive: this PR
2. macOS Seatbelt enforcement: Enforce workspace metadata protections in Seatbelt #19847
3. Shell preflight UX: Add workspace metadata shell preflight #19848
4. Runtime permission propagation: Propagate runtime permission profiles #19849
5. Linux bubblewrap enforcement: Enforce workspace metadata protections in Linux sandbox #19852

Validation

1. cargo test --manifest-path codex-rs/Cargo.toml -p codex-protocol permissions
2. cargo fmt --manifest-path codex-rs/Cargo.toml --package codex-protocol --package codex-linux-sandbox
3. git diff --check

[chatgpt-codex-connector]

💡 Codex Review

codex/codex-rs/protocol/src/permissions.rs

Lines 726 to 728 in ab4b378

	self.semantic_signature(cwd)
	!= FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(&legacy_policy, cwd)
	.semantic_signature(cwd)

Include preserved-write semantics in enforcement bridging check

needs_direct_runtime_enforcement decides compatibility by comparing semantic signatures, but preserved-name write denials are enforced in can_write_path_with_cwd and are not represented in the bridged legacy model. This can return false and skip direct enforcement even when .git/.agents/.codex writes should be blocked.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Restrict preserved-name blocking to root-level metadata

can_write_path_with_cwd calls first_preserved_component, which scans all path components and denies writes whenever any component is .git, .agents, or .codex unless there is a deeper explicit rule. This blocks legitimate nested repo writes (e.g. /tmp/repo/.git/...) under otherwise writable roots, so common flows like cloning in /tmp regress.

Useful? React with 👍 / 👎.