Codex Agent Host on Linux: workspace sandbox hides the bundled Codex executable

Does this issue occur when all extensions are disabled?: Not tested.

## Summary

Codex Agent Host cannot run even `pwd` or `ls`: bubblewrap fails before the shell starts because the workspace permission profile hides the bundled Codex executable. The binary exists and is running the App Server.

## Environment

- VS Code Version (Server): `1.138.0` (`7debcd0e2acdea1c52de81bf9ee1620444407dda`)
- OS Version (remote host): Ubuntu 26.04.1 LTS, Linux x64, kernel `7.0.0-27-generic`
- Connection: Remote SSH
- Agent Host's bundled Codex: `0.153.0`, selected by `product.json`

## Steps to reproduce

1. On Linux, start a Codex Agent Host session with workspace sandboxing enabled.
2. Ask the agent to run `pwd` or `ls`.

Expected: the command runs within the workspace sandbox.

Actual: the command fails before the shell starts:

```text
bwrap: execvp /home//.vscode-server/data/agent-host/sdk-cache/codex/0.153.0/linux-x64/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/bin/codex: No such file or directory
```

Restarting the remote VS Code Server did not resolve the failure.

## Findings

The App Server receives this permission profile, generated by [`codexPermissionProfileOverrides()` in `codexLaunchConfig.ts`, lines 16–36](https://github.com/microsoft/vscode/blob/7debcd0e2acdea1c52de81bf9ee1620444407dda/src/vs/platform/agentHost/node/codex/codexLaunchConfig.ts#L16-L36) at the affected VS Code commit:

```toml
permissions.vscode-workspace = { extends = ":workspace", filesystem = { ":root" = "deny", ":minimal" = "read", ":tmpdir" = "write", ":slash_tmp" = "read" }, network = { enabled = false } }
```

This appears related to [openai/codex#29049](https://github.com/openai/codex/issues/29049). The Linux `/tmp` read access from [#335409](https://github.com/microsoft/vscode/pull/335409) is already present; here, the hidden executable is under the SDK cache in the user's home directory.

Could Agent Host ensure that its bundled Codex runtime remains readable inside the workspace sandbox, or adopt an upstream SDK fix when available?

Start in src/vs/platform/agentHost/node/codex/codexLaunchConfig.ts, especially codexPermissionProfileOverrides() at lines 16–36, and inspect how the workspace permission profile reaches the Linux sandbox. Reproduce with workspace sandboxing enabled by running pwd or ls in a Codex Agent Host session. Done means the bundled Codex executable remains accessible and commands run inside the workspace sandbox.

Written by the indexing model from the issue text.