Investigate virtual workspace roots set by other extensions

🐛 Bug: VS Code Codex searches entire filesystem instead of workspace (should ignore writable_roots for search)

Summary

When using the Codex VS Code extension, adding context or typing @ triggers a file search that crawls my entire disk.
Search should only look within the open workspace, regardless of what’s in writable_roots.

This causes multi-minute hangs before results appear and includes files from /System, /usr, etc.

---

🧩 Steps to Reproduce

1. Open a workspace (e.g., /Users/username/il/monorepo).
2. Open Codex chat.
3. Type @ or use “Add context” to search for a file.
4. Observe:

• “Searching…” spinner runs for minutes.
• Results eventually include files far outside the workspace (even system-level ones).

---

✅ Expected

• File search should be scoped to the open workspace (or VS Code project folder).
• It should not depend on writable_roots in ~/.codex/config.toml.
• writable_roots should define where Codex can write, not what it can search.

---

❌ Actual

Codex’s session logs show that it adds / to writable_roots, causing a full-disk crawl:

"writable_roots": [
  "/Users/username/projects/monorepo",
  "/"
]

🖼️ Screenshot

Below, @AGENTS.md shows results from multiple system paths instead of limiting to the workspace:

!codex-global-search-bug