Whitelisted commands lose sandbox bypass in compound commands

Problem

With ["gh", "auth", "status"] in Approved command prefixes, standalone gh auth status bypasses the sandbox. The github:yeet workflow may nevertheless batch it with repository checks before publishing:

git status -sb && git diff && gh auth status

The standalone gh auth status allow rule does not bypass the sandbox because the preceding git segments have no explicit allow rule. The whole invocation stays sandboxed, so gh may be unable to access the host keyring and incorrectly report an invalid token.

Root cause

codex-rs/core/src/exec_policy.rs only bypasses the sandbox when every parsed shell segment has an explicit allow match. The model-facing instructions say segments are evaluated independently, but omit that condition.

Proposed clarification

Add this after the command-segmentation guidance in:

• codex-rs/prompts/templates/permissions/approval_policy/on_request.md
• codex-rs/prompts/templates/permissions/approval_policy/on_request_rule_request_permission.md

Exec-policy allows sandbox bypass only when every shell segment has an explicit allow match. Run whitelisted commands standalone.

This preserves the security model while preventing an avoidable failure in a common GitHub publishing workflow.