P0 linux-sandbox: isolate Codex translation behind the helper process

[novelKR]

Summary

• Move Codex PermissionProfile / sandbox-argv translation behind a binary-only codespace-linux-sandbox helper. The runner talks probe / prepare / run --plan over serde JSON (SANDBOX_HELPER_PROTOCOL=1); Codex argv never leaves the helper (opaque 0600 plan in a random 0700 directory, then exec of the same PID).
• codespace-runner drops the helper library path dep and depends only on crates/linux-sandbox-protocol. #53 spawn/advertisement semantics stay: probe false → direct argv + none; probe true → linux-sandbox / Restricted enforced; no unsandboxed fallback. Prepare / protocol / helper OS-spawn failure is PROCESS_SPAWN_FAILED. After a managed helper spawn succeeds, run --plan load, self-exec, or inner sandbox failure is a managed process exit. WIRE_PROTOCOL remains 3. Network Enabled / proxy is not in this PR.
• Preserve #53 follow-ups on main: helper Read in the Minimal profile, Clippy cfg branches, parallel CI (userns + isolation scoped to --test isolation), and refresh the isolated runtime lock so it no longer carries the helper library. Rama 0.3.0-alpha.4 leaf guards stay on the helper lock and are also pinned on crates/file-system (and the isolated crates/codex-runtime lock) because root still sees that graph through codespace-fs.
• Helper prepare now writes stdin, reads stdout/stderr, and waits for exit inside one timeout. Output size is capped while reading; timeout kills and reaps the prepare child.

Test plan

• cargo fmt (root + crates/linux-sandbox)
• ./scripts/check-no-model-deps.sh
• python3 -B scripts/check_docs.py
• cargo tree -p codespace-runner has no codespace-linux-sandbox / codex-linux-sandbox
• cargo metadata --locked --offline --manifest-path crates/codex-runtime/Cargo.toml
• Runner unit tests: unread large stdin times out; stdout flood is output too large
• CI: protocol crate unit tests; helper --bins --test cli; CODESPACE_REQUIRE_LINUX_SANDBOX=1 isolation; workspace tests with CODESPACE_LINUX_SANDBOX_BIN
• Rust / Clippy (root) and Clippy (codex-adapters) green, including cargo tree after root clippy
• Linux isolation: workspace RW vs outside path, private /tmp, AF_INET denied / AF_UNIX allowed, PTY isatty + stdin, terminate reaps the tree
• Missing executable: helper spawn succeeds (managed exit) when probe is true; PROCESS_SPAWN_FAILED when probe is false
• Advertisement and MCP tool names unchanged; WIRE_PROTOCOL=3
• Empty trailing argv ("") survives opaque plan roundtrip; leftover codespace-linux-sandbox-* plan dirs are removed after run