fix: enable Codex sandbox in Docker

Dockerfile

@@ -24,11 +24,13 @@ ENV PYTHONDONTWRITEBYTECODE=1 \
     PATH=/opt/agentci/.venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 
 RUN apt-get update \
-    && apt-get install --yes --no-install-recommends adduser ca-certificates git libstdc++6 \
+    && apt-get install --yes --no-install-recommends \
+        adduser bubblewrap ca-certificates git libstdc++6 \
     && rm -rf /var/lib/apt/lists/* \
     && /usr/sbin/adduser --disabled-password --gecos "" --uid 10001 agentci \
     && mkdir -p /opt/agentci /var/lib/agentci /var/lib/codex /etc/codex /run/agentci \
-    && chown agentci:agentci /run/agentci
+    && chown agentci:agentci /run/agentci \
+    && chmod u+s /usr/bin/bwrap
 
 COPY --from=uv /uv /uvx /usr/local/bin/
 COPY --from=tea /bin/tea /usr/local/bin/tea
@@ -36,6 +38,9 @@ COPY --from=codex /usr/local/bin/node /usr/local/bin/node
 COPY --from=codex /usr/local/lib/node_modules/@openai/codex /usr/local/lib/node_modules/@openai/codex
 COPY --from=codex /usr/local/lib/node_modules/@colbymchenry /usr/local/lib/node_modules/@colbymchenry
 RUN ln -s /usr/local/lib/node_modules/@openai/codex/bin/codex.js /usr/local/bin/codex \
+    && ln -s \
+        /usr/local/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/bin/codex \
+        /usr/local/bin/codex-linux-sandbox \
     && ln -s /usr/local/lib/node_modules/@colbymchenry/codegraph/npm-shim.js \
         /usr/local/bin/codegraph