Let multi-repo and repo-less Codex runs start

[ppXD]

Summary

• A Codex run whose cwd is not inside a git repository could not start. Codex 0.142.2 exits 1 before any model request ("Not inside a trusted directory and --skip-git-repo-check was not specified"), for exec and exec resume <id> alike, and a projects trust entry does not change that. Two kinds of run have such a cwd: a multi-repo run, which works at the workspace root, and a repo-less run, which works in the scratch directory from ScratchWorkspaceHandle. So every multi-repo and every repo-less Codex run failed at start. CodexHarness.BuildInvocation (backend/src/CodeSpace.Core/Services/Agents/Harnesses/Codex/CodexHarness.cs) now passes --skip-git-repo-check on both seeds. At a git cwd the flag changes nothing the model is sent.
• At a multi-repo root, Codex's own workspace-write sandbox kept .git, .codex and .agents read-only only at the top of each writable root. That sandbox is the only boundary where our runner does not confine. So each repository's .git/hooks and .git/config were writable to the agent, and the platform's own commit and push run git there with the run's credential. Each repository below the cwd is now passed as -c sandbox_workspace_write.writable_roots=[...], which gives it the same carve-outs a single-repo cwd gets. No write access is added, and the single-repo argv is unchanged. Under our confinement Codex's sandbox is stood down and ignores the table.
• E2E against the pinned CLIs:
  • The multi-repo arm also plants hostile config at the workspace root, the only place Codex reads project config from in that layout, so it now fails when the distrust is dropped. It is renamed …_and_loads_no_config_from_it.
  • New repo-less arm in a scratch directory.
  • The resume stand-down arm now runs at a non-git multi-repo root.
  • New unconfined-lane arm (UnconfinedWorkerE2ETests): the agent tries to append to each repository's .git/hooks/pre-push, .git/config and .codex/config.toml.
  • Gates in .github/workflows/sandbox-isolation.yml: root floor 92, unconfined lane 4, and the new markers are required.

Not in this change: hardening the platform's own git commands against repo-local hooks and config. Under confinement that exposure already exists and is pinned by A_standard_codex_writes_its_workspace_under_our_confinement_but_not_the_system_root. Loading sub-repository instructions at a multi-repo root is also left out.

Test plan

• Unit: CodexHarnessTests 147/147 (argv for fresh and resumed multi-repo runs; no override for single-repo, scratch, read-only, a repository outside the cwd, or a prefix-only sibling; TOML quoting). Full unit suite: 11701 passed, 0 failed
• Integration (Codex / multi-repo / workspace / harness filter): 223 passed, 2 real-model skips
• Sandbox E2E on macOS against Codex 0.142.2 and Claude 2.1.263: 30/30 in the touched classes; whole sandbox suite 0 failures
• Mutations against the real CLI: dropping the writable roots, the distrust, the resume seed's flag, or the flag on both seeds each makes the arm that guards it fail
• CI sandbox-isolation: the unconfined-lane arm is the first run of Codex's own sandbox on Linux (uid 1654); the carve-out has only been observed on macOS