Enforce workspace metadata protections in Seatbelt

[evawong-oai]

Summary

Teach the macOS Seatbelt sandbox to enforce protected workspace metadata names supplied by the shared policy primitive.

Scope

1. Thread protected_metadata_names into Seatbelt access roots.
2. Emit sandbox rules that deny creating or replacing protected metadata path names under writable roots.
3. Add coverage for first time metadata path creation attempts and read only carveouts.

Reviewer Focus

1. This PR only covers the macOS sandbox path.
2. Metadata names are supplied by policy rather than hard coded in command preflight.
3. Read only subpath carveouts and metadata protection checks should compose cleanly.

Stack

1. Policy primitive: Add workspace metadata protection policy primitive #19846
2. macOS Seatbelt enforcement: this PR
3. Shell preflight UX: Add workspace metadata shell preflight #19848
4. Runtime permission propagation: Propagate runtime permission profiles #19849
5. Linux bubblewrap enforcement: Enforce workspace metadata protections in Linux sandbox #19852

Validation

1. cargo test --manifest-path codex-rs/Cargo.toml -p codex-sandboxing seatbelt
2. cargo fmt --manifest-path codex-rs/Cargo.toml --package codex-sandboxing