Support recursive trusted project roots

What variant of Codex are you using?

CLI

What feature would you like to see?

Codex currently appears to require exact per-repo trust entries like:

[projects."/Users/me/repos/some-repo"]
trust_level = "trusted"

For users who keep many trusted repositories under a known parent directory, it would be useful to support an explicit trusted umbrella/root, for example:

[projects."/Users/me/repos"]
trust_level = "trusted"
recursive = true

or an equivalent dedicated setting such as:

trusted_roots = ["/Users/me/repos"]

This would let repositories under /Users/me/repos/* inherit trusted status without cluttering config.toml with one entry per repo. Exact child entries should still be able to override the inherited trust, e.g. marking a sensitive subdirectory as untrusted.

Additional information

Related pain points have come up around exact-path trust, wildcard/global trust not working, and config.toml accumulating many auto-added trust entries. This request is narrower than trusting every directory globally: it asks for an explicit recursive trust boundary chosen by the user.