fix: respect Codex sandbox platform defaults

[cyrusagent]

Assignee: @Connoropolous (connor)

Summary

• Make Codex runner respect platform-provided sandbox defaults instead of forcing Cyrus defaults.
• Keep explicit sandbox configuration behavior intact when users/repository config sets it.
• Add targeted tests for implicit vs explicit sandbox behavior and document validation with an F1 test drive.

Implementation Approach

• Updated CodexRunner.buildThreadOptions() to only pass sandboxMode when config.sandbox is explicitly provided.
• Removed implicit sandbox_workspace_write override injection from CodexRunner.buildConfigOverrides().
• Added coverage in CodexRunner.mcp-config.test.ts for:
  • no injected sandbox config when unset,
  • preserving explicit sandbox_workspace_write config,
  • no defaulted sandboxMode when unset,
  • forwarding explicit sandboxMode.

Testing Performed

• pnpm --filter cyrus-codex-runner test:run (pass)
• pnpm --filter cyrus-edge-worker exec vitest run test/AgentSessionManager.codex-runner-activity.test.ts test/EdgeWorker.runner-selection.test.ts (pass)
• pnpm lint (pass)
• pnpm typecheck (pass)
• F1 protocol test drive documented at apps/f1/test-drives/2026-03-02-cypack-868-codex-sandbox-defaults-validation.md.

Breaking Changes / Migration Notes

• None.

Linear Issue

• CYPACK-868