`sandbox-mode` seems ignored in `config.toml`

What version of Codex is running?

codex-cli 0.22.0

Which model were you using?

gpt-5-mini

What platform is your computer?

Darwin 24.6.0 arm64 arm

What steps can reproduce the bug?

I believe this is a fair representation of my config.toml, I'm excerpting it for privacy a bit, but all the other properties take effect except approval_policy so, I think this is valid reproducer:

[profiles.gpt-5-mini-private]
model = "gpt-5-mini"
model_provider = "openai"
approval_policy = "on-failure"
sandbox_mode     = "workspace-write" 👈 
model_reasoning_effort = "high"
model_reasoning_summary = "auto"

When I start codex as:
codex --profile=gpt-5-mini-private it has the wrong approval mode:

>_ You are using OpenAI Codex in ~/workspace/private

 To get started, describe a task or try one of these commands:

 /init - create an AGENTS.md file with instructions for Codex
 /status - show current session configuration and token usage
 /diff - show git diff (including untracked files)
 /prompts - show example prompts

/status
📂 Workspace
  • Path: ~/workspace/private
  • Approval Mode: on-failure
  • Sandbox: read-only 👈 
  • Session ID: c6ec117d-09c2-4388-9e34-231a3a1ef9e3

🧠 Model
  • Name: gpt-5-mini
  • Provider: OpenAI
  • Reasoning Effort: High
  • Reasoning Summaries: Auto

📊 Token Usage
  • Input: 0
  • Output: 0
  • Total: 0

▌ Ask Codex to do anything
 ⏎ send   Shift+⏎ newline   Ctrl+C quit

Notice the Sandbox setting is wrong ☝️

I must launch like this:

codex --profile=gpt-5-mini-private --sandbox=workspace-write

in order to get the correct setting because config.toml seems ignored.

 To get started, describe a task or try one of these commands:

 /init - create an AGENTS.md file with instructions for Codex
 /status - show current session configuration and token usage
 /diff - show git diff (including untracked files)
 /prompts - show example prompts

/status
📂 Workspace
  • Path: ~/workspace/private
  • Approval Mode: on-failure
  • Sandbox: workspace-write 👈 
  • Session ID: 6cbd2218-4a3f-460c-bf58-870ee2cfc977

🧠 Model
  • Name: gpt-5-mini
  • Provider: OpenAI
  • Reasoning Effort: High
  • Reasoning Summaries: Auto

📊 Token Usage
  • Input: 0
  • Output: 0
  • Total: 0

▌ Ask Codex to do anything
 ⏎ send   Shift+⏎ newline   Ctrl+C quit

What is the expected behavior?

Setting sandbox_mode = "workspace-write" in the config.toml expected to see sandbox: workspace-write in the status.

What do you see instead?

sandbox: read-only in the status.

Additional information

_No response_