[codex] preserve sandbox across Codex resume

[vaope]

Summary

Closes #960.

This fixes silent Codex sandbox drift across resume invocations by explicitly replaying the configured sandbox mode on the resume args path.

What Changed

• Add --config sandbox_mode="..." to Codex resume invocations while keeping --sandbox and --add-dir off resume, preserving the existing resume CLI contract.
• Update the CodexAgentService.ts design comment and CLI example so the resume asymmetry is documented.
• Change missing Codex runtime settings fallback in the Hub editor from workspace-write to danger-full-access. This is intentional: it matches the current dev-default and prevents a missing UI config from silently narrowing the sandbox.
• Prefer the official Windows Codex desktop runtime / CODEX_CLI_PATH before npm shims, reducing Windows sandbox helper/elevation instability.
• Normalize Windows command shim resolution to prefer .cmd over PowerShell .ps1 fallbacks.

Root Cause

Fresh Codex exec passed --sandbox, but the resume path omitted it because codex exec resume rejects --sandbox / --add-dir. The old design assumed the CLI would preserve the sandbox from session creation. When resume falls back to a CLI default, agents see a silent permissions transition with no provenance.

The fix completes the existing design by using the config channel accepted by resume: --config sandbox_mode="...".

Validation

• pnpm run build passed from packages/api
• Targeted API tests passed after rebase: 86 tests, 82 pass, 4 skip, 0 fail
  • test/codex-agent-service.test.js
  • test/cli-resolve.test.js
  • test/windows-portable-redis-tools.test.js
• Targeted web test passed after rebase: pnpm.CMD --dir ../web exec vitest run src/components/__tests__/hub-cat-editor.test.tsx with 57/57 pass

Notes

Full web vitest was attempted before the rebase via pnpm.CMD --dir ../web exec vitest run; it hit pre-existing/environmental failures unrelated to this patch:

• Windows command environment lacks grep for color-token-audit.test.ts
• Existing CliDiagnosticsPanel path redaction expectation mismatch
• Existing F190 raw pixel font guard failures in dev OKLCH tuner files

[zts212653]

Thanks for opening the PR. I’m treating #980 as the active fix path for clowder-ai#960.

Since this is still marked as draft, I won’t start formal code review yet. Once you mark it ready for review, we’ll review the PR rather than opening a separate implementation track.

I added triage labels to make the current state explicit. The main maintainer decision point I see is the intentional missing-settings fallback change from workspace-write to danger-full-access: that aligns with the existing CAT_CODEX_SANDBOX_MODE default, but it is still a user-visible permission default and needs explicit maintainer confirmation before merge.

[砚砚/gpt-5.5🐾]