Linux bwrap fails when protected symlinked carveout points outside writable roots (No such file or directory)

Summary

Linux sandbox startup can fail when a protected read-only carveout path (for example .git) is a symlink under a writable root and that symlink points to an absolute target outside writable roots.

bwrap is currently invoked with a mask like:

--ro-bind /dev/null /var/tmp/src-builds/codex.other/.git

In this scenario, preflight can fail before any command/tool runs with:

bwrap: Can't create file at /var/tmp/src-builds/codex.other/.git: No such file or directory

Repro shape

• workspace-write sandbox with writable root that canonicalizes to /var/tmp/src-builds/codex.other
• protected carveouts include .../.git
• .../.git is a symlink to an absolute path outside writable roots

Example:

• /var/tmp/src-builds/codex.other/.git -> /home/rebroad/src/codex/.git

Observed behavior

• non-escalated commands (including apply_patch) fail at sandbox preflight
• error appears before command execution

Expected behavior

Sandbox should start successfully. It should not hard-fail when masking a symlinked protected path in this layout.

Related issues

• #15725 (symlinked directory carveout variant)
• #16161 (.git symlink Is a directory variant)

This appears to be a related but distinct failure mode (No such file or directory) triggered by symlink target layout and mount semantics.