Support glob patterns in features.network_proxy.unix_sockets

Summary

[features.network_proxy].unix_sockets currently accepts a map keyed by absolute paths, but those keys are treated literally. There is no way to allow a bounded family of dynamically named Unix sockets without allowing an entire parent directory or setting dangerously_allow_all_unix_sockets = true.

Current behavior

For example, this does not match /private/tmp/service-123.sock:

[features.network_proxy]
enabled = true
unix_sockets = { "/private/tmp/*.sock" = "allow" }

In the macOS Seatbelt implementation, configured paths are normalized as absolute paths and emitted as subpath rules; no glob matching is performed. See normalization and Unix-socket policy generation.

The current directory-level workaround:

unix_sockets = { "/private/tmp" = "allow" }

also permits every Unix socket under /private/tmp, which is wider than necessary.

Request

Support an explicit, documented glob syntax for unix_sockets, for example:

unix_sockets = { "/private/tmp/*.sock" = "allow" }

The implementation should preserve existing literal absolute-path semantics and fail closed for invalid or ambiguous patterns. The generated Seatbelt policy should remain bounded to the intended matching paths.

Motivation

Developer daemons often create Unix sockets with dynamic filenames. A narrowly scoped glob would avoid choosing between an overly broad directory allowlist and dangerously_allow_all_unix_sockets = true.

Scope

This request is specifically about AF_UNIX configuration. It is not intended as a workaround for daemons that use TCP loopback instead of Unix sockets.

Start with the normalization code in codex-rs/sandboxing/src/seatbelt.rs around lines 2042-2066 and Unix-socket policy generation around lines 2132-2192. Define and document the supported glob syntax while preserving literal absolute paths and rejecting invalid or ambiguous patterns. Done means the generated Seatbelt policy remains bounded to the intended socket paths.