Support readable files below sandbox denies

[winston-openai]

Why

Managed MITM must expose the active CA bundle to a sandboxed command without making the proxy directory, private key, or stale sibling bundles readable.

What

• add read-only file carvebacks beneath denied parents for Seatbelt and bubblewrap
• keep each carveback scoped to the active bundle for that command
• close Linux cleanup-parent bundle descriptors before untrusted code starts
• cover the split deny/read behavior on macOS and Linux

Stack

• Parent: Materialize child MITM CA bundles #26315
• Child: Snapshot managed proxy child environments #28967

Validation

• just test -p codex-sandboxing
• just test -p codex-linux-sandbox --no-tests=pass

[winston-openai]

Closing as superseded by the focused #29013 and #29014 stack. The replacement isolates the persisted MITM private key and preserves file-backed custom CAs present at Codex startup, with zero codex-core changes. Per-command bundle materialization, generic sandbox carvebacks, and additional shell-snapshot plumbing are intentionally deferred because they are not required for this scoped completion work.