Codex sandbox returns EINVAL instead of EPERM for setuid() etc

What issue are you seeing?

This breaks test suites like https://github.com/ruby/spec when run under the Codex sandbox.

• Codex version: codex-cli 0.144.3
• Sandbox mode: workspace-write
• Env marker: CODEX_CI=1

What steps can reproduce the bug?

  begin
    Process.uid = 0
  rescue SystemCallError => e
    p [e.class, e.errno, e.message]
  end

Expected outside the Codex sandbox as a non-root user:

[Errno::EPERM, 1, "Operation not permitted"]

Observed in the Codex sandbox here:

[Errno::EINVAL, 22, "Invalid argument"]

Command form:

ruby -e 'begin; Process.uid = 0; rescue SystemCallError => e; p [e.class, e.errno, e.message]; end'

What is the expected behavior?

EPERM

Additional information

_No response_