Any filesystem deny rule prevents exiting the sandbox after approval

What issue are you seeing?

When the current permission profile contains any deny rule, codex will not exit the sandbox after asking for approval. This makes escalation basically useless.

This is not documented at https://learn.chatgpt.com/docs/permissions

What steps can reproduce the bug?

• Use some profile of the new permissions that uses deny on some paths
• Tell codex to access that path, e.g. with ls
• Approve escalation to run out of sandbox

What is the expected behavior?

Deny rules should not be so special cased.

If the behaviour "deny always, even after escalation" is required, maybe:

• add a new keyword
• allow specifying which profile codex can escalate TO, so that even the escalated profile could still deny some paths.

Additional information

https://github.com/openai/codex/blob/rust-v0.144.2/codex-rs/core/src/tools/sandboxing.rs#L250-L307