Add read-restricting sandbox mode for Codex CLI

Description

Today the sandbox only blocks writes (and optionally network); reads are always allowed
(see codex-rs/linux-sandbox/src/landlock.rs TODO about has_full_disk_read_access and the
unconditional access_ro rule for "/"). I’m using Codex as a shell executor in the
openai-agents-python project and need to confine filesystem reads to a specific folder
(like a chroot/bwrap view) so the model cannot inspect the rest of the host.

Request

add a sandbox policy that constrains read access to declared roots, across macOS Seatbelt
and Linux Landlock, including CLI flags/config so the allowed paths can be set explicitly.

Motivation

Security/privacy: prevent the model-driven shell from reading secrets or unrelated files
outside a designated workspace. This complements the existing write and network controls
and removes the need for external containers/bwrap just to restrict reads.

Acceptance Criteria

• New sandbox mode/config flag that limits readable roots; defaults preserve current behavior.
• On Linux, Landlock rules omit access_ro to "/" unless explicitly allowed; on macOS, the

Seatbelt profile mirrors the same read constraints.

• CLI/docs updated to show how to launch Codex with a read-limited workspace root.

Additional information

_No response_