workspace-write sandbox fails when .git is a symlink created by Android repo

What variant of Codex are you using?

CLI

What feature would you like to see?

Title:
workspace-write sandbox fails when .git is a symlink created by Android repo

Environment:

• OS: Linux
• Codex version: <codex-cli 0.139.0>
• Sandbox mode: workspace-write
• Repo manager: Android repo

Repository layout:
<workspace>/.git -> <repo-meta-dir>/projects/<project>.git

Config tried:
[sandbox_workspace_write]
writable_roots = [
"<repo-root>",
"/tmp",
]

Actual behavior:
Any sandboxed shell command fails before execution, even pwd or true:

error building bubblewrap command:
Fatal error: cannot enforce sandbox read-only path
<workspace>/.git
because it crosses writable symlink
<workspace>/.git

Expected behavior:
Codex should support repo-managed .git symlinks, or resolve and protect the target Git directory read-only, or fall back to an approval request instead of making all
sandboxed commands unusable.

Notes:
This is not asking to make .git writable. The goal is to preserve Codex's protected .git behavior while supporting repo-style Git metadata symlinks.

Additional information

_No response_