[codex] harden sandbox boundaries and add capability probes

[wusuiling-if]

What changed

• harden Bubblewrap with fully unshared namespaces and private runtime mounts
• restrict macOS sandbox-exec writes to the workspace and executor-owned runtime
• run Docker as the invoking POSIX UID:GID with explicit private environment values
• add the provider-free mca sandbox probe command
• add automatic real-backend CI for Bubblewrap, Docker, and sandbox-exec
• lock the sandbox workflow to reviewed triggers, runners, steps, commands, and immutable actions
• document exact backend limits and release the package as 0.3.3

Why

The previous runtime had avoidable host-runtime exposure and capability probes that could infer isolation from unrelated command failures. This change makes every boundary check fault-sensitive: native writes require reserved errno evidence, Docker verifies the root mount's read-only flag, socket visibility is backend-specific, and network checks distinguish Docker bridge routing from a networkless container.

Impact

• mca sandbox probe --sandbox auto validates disposable write, socket, and network boundaries without a provider key or target repository.
• Docker-created workspace files use the invoking host UID:GID on POSIX.
• Custom Docker images used for coding/tests need /bin/sh; the capability probe additionally needs python3.
• Native process cleanup remains best effort and is documented as such.

Validation

• 250 passed, 1 skipped
• offline verified-patch benchmark: 11/11
• real local sandbox-exec integration and CLI probe: all checks passed
• clean wheel install: version, demo, doctor, probe, and pip check passed
• wheel and sdist passed Twine checks
• independent whole-branch and adversarial reviews: no Critical, Important, or Minor findings

Real Docker and Bubblewrap execution is covered by the new dedicated GitHub Actions workflow.