Hosted Agent: Codex Agent: agent unable to read it's own path, e.g. `~/.codex`, in `Auto-Review` mode

Does this issue occur when all extensions are disabled?: Yes/No

- VS Code Version: 1.138.0
- OS Version: 15.7.9 (24G830)

Steps to Reproduce:

1. Open `Hosted Agents` window
2. Pick `Codex` agent, with `Auto-Review` mode
3. run any prompt

If you check chain of thought carefully, you would see tons of `Operation not permitted` on
- `.codex/plugins/cache/`
- `.codex/skills`
- even file under workspace, which is one folder up from pwd in my case.

If I switch to `Full Access` mode, everything back to normal.

I do checked a few related settings, `chat.agent.sandbox.enabled`, which are all disabled.