Windows sandbox: .git file entries under writable roots are not denied

What version of Codex is running?

OpenAI Codex (v0.80.0)

• VS Code plugin "Codex - OpenAI's coding agent" (0.4.60)
• Codex CLI (v0.80.0)

What subscription do you have?

Via API.

Which model were you using?

gpt-5.2-codex xhigh

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What terminal emulator and version are you using (if applicable)?

PowerShell 5.x

What issue are you seeing?

In codex-rs/windows-sandbox-rs/src/allow.rs, the denylist only adds .git when it is a directory (.is_dir()), but Git worktrees and submodules often use a file .git that points to the actual gitdir. This means .git file entries under writable roots are not denied, so repo metadata/config can be accessed in WorkspaceWrite mode.

What steps can reproduce the bug?

1. On Windows, create a repo and add a worktree (e.g., git worktree add ..\\wt), which creates a .git file in the worktree root.
2. Run Codex with a WorkspaceWrite policy in that worktree.
3. Observe that the sandbox denylist does not include the .git file, allowing access to .git metadata.

What is the expected behavior?

The sandbox should deny access to .git entries under writable roots regardless of whether .git is a directory or a file.

Additional information

This is a Windows-only behavior. The check currently uses git_dir.is_dir(); it should handle .git files used by worktrees/submodules.