Enforce workspace metadata protections in Linux sandbox

[evawong-oai]

Summary

Teach Linux bubblewrap to enforce protected workspace metadata names so writable roots cannot create or replace .git, .codex, or .agents unless user policy explicitly allows it.

Scope

1. Convert protected metadata names into protected create targets for writable roots.
2. Keep bind mount targets valid while masking missing metadata paths.
3. Add Linux sandbox launcher coverage for first time metadata path creation, explicit carveouts, and normal git operations.

Reviewer Focus

1. This PR only covers Linux bubblewrap enforcement.
2. Policy shape is introduced in Add workspace metadata protection policy primitive #19846.
3. macOS enforcement is handled separately in Enforce workspace metadata protections in Seatbelt #19847.
4. Normal git operations should still work when git metadata already exists.

Stack

1. Policy primitive: Add workspace metadata protection policy primitive #19846
2. macOS Seatbelt enforcement: Enforce workspace metadata protections in Seatbelt #19847
3. Shell preflight UX: Add workspace metadata shell preflight #19848
4. Runtime permission propagation: Propagate runtime permission profiles #19849
5. Linux bubblewrap enforcement: this PR

Validation

1. cargo test --manifest-path codex-rs/Cargo.toml -p codex-linux-sandbox bwrap
2. cargo check --manifest-path codex-rs/Cargo.toml -p codex-cli -p codex-core
3. cargo fmt --manifest-path codex-rs/Cargo.toml --package codex-linux-sandbox
4. git diff --check
5. Forty six devbox cases passed on the earlier stacked head using the just c harness. Not rerun after this terminology only rewrite yet.