Codex Agent Host Auto-Review approves sandbox escalation but still runs the command inside the sandbox on macOS

## Type of issue

Bug

## Environment

- VS Code: 1.138.0
- Commit: 7debcd0e2acdea1c52de81bf9ee1620444407dda
- OS: macOS arm64
- Codex Agent Host bundled SDK: 0.153.0
- Session target: Codex on Agent Host
- Permission preset: Auto-Review

## Description

When Codex runs through the experimental Agent Host, Auto-Review accepts an explicit sandbox escalation request, but the command is still executed under the same managed sandbox profile.

This makes Auto-Review unusable for routine commands that need read access outside the workspace, including Git reading the user configuration and Apple developer tools reading or updating their caches.

The same commands work immediately after selecting Full Access. They also worked through the OpenAI Codex extension before switching to Agent Host.

## Steps to reproduce

1. Enable `chat.agentHost.codexAgent.enabled`.
2. Enable `chat.editor.codex.preferAgentHost` and restart VS Code.
3. Start a local Codex Agent Host session in a Git repository on macOS.
4. Select the Auto-Review permission preset.
5. Run `git status --short` through the Codex shell tool.
6. Observe the sandbox failure.
7. Retry the command with `sandbox_permissions: "require_escalated"` and a justification.
8. Auto-Review does not reject the request, but the retry produces the same sandbox errors.
9. Select Full Access and run the same command. It succeeds immediately.

## Actual behavior

The initial command fails with errors similar to:

```text
git: error: could not create cache file /var/folders/.../T/xcrun_db-* (errno=Operation not permitted)
fatal: unable to access $HOME/.gitconfig: Operation not permitted
```

Reading an explicitly configured user skill outside the workspace behaves the same way:

```text
sed: $HOME/.agents/skills/example/SKILL.md: Operation not permitted
```

An explicit `require_escalated` retry accepted by Auto-Review returns the same errors, which indicates that the sandbox override is ignored or lost between the reviewer decision and command execution.

## Expected behavior

After Auto-Review approves `require_escalated`, VS Code should rerun the command outside the managed sandbox, matching the documented escalation behavior.

If the automatic reviewer cannot authorize an unsandboxed retry, VS Code should surface a human approval prompt instead of silently rerunning with unchanged restrictions.

## Additional information

- Full Access proves that the binaries, files, and commands themselves are valid.
- Default Permissions and Auto-Review use the same workspace access, but Auto-Review routes approval requests to the automatic reviewer.
- Codex Agent Host currently overrides custom Codex permission configuration, so `~/.codex/config.toml` cannot provide a narrower workaround.

Possibly related:

- https://github.com/microsoft/vscode/issues/333898
- https://github.com/microsoft/vscode/issues/334445
- https://github.com/openai/codex/issues/36391