Sandboxed tool calls fail on Ubuntu 22.04 bubblewrap 0.6.1 because codex-linux-sandbox always passes --argv0

What issue are you seeing?

On Ubuntu 22.04 systems with the distro-packaged bubblewrap 0.6.1, sandboxed Codex tool calls fail immediately because codex-linux-sandbox always injects --argv0, but that bwrap build does not support the flag. In practice this breaks sandboxed operations such as apply_patch with errors like:

bwrap: Unknown option --argv0

What steps can reproduce the bug?

1. Install Codex CLI on Ubuntu 22.04.
2. Use the distro bubblewrap package (bubblewrap 0.6.1-1ubuntu0.1).
3. Run any Codex flow that executes a sandboxed tool call, for example an apply_patch request under workspace-write.
4. Observe the sandbox helper fail before the requested command runs.

A direct system check on the affected host shows that bwrap --help does not list --argv0.

What is the expected behavior?

Codex should detect whether the local bwrap supports --argv0 and only pass that flag when it is available, so sandboxed commands continue to work on older but supported distro packages.

Additional information

I verified a local fix that checks bwrap --help once, caches whether --argv0 is supported, preserves the existing behavior on newer bubblewrap builds, and skips the flag on older builds. Focused regression tests cover both paths.