0.150.1: untrusted project AGENTS.md is included in prompt input

Codex version

codex-cli 0.150.1

Environment

macOS arm64. Reproduced with a fresh temporary CODEX_HOME and a disposable Git repository.

Reproduction

1. Create a disposable Git repository whose AGENTS.md contains a unique sentinel.
2. Use a fresh CODEX_HOME.
3. Run:

CODEX_HOME=/path/to/fresh-home codex -C /path/to/repo debug prompt-input \
  -c 'projects."/path/to/repo".trust_level="untrusted"' \\\n  'probe input'\n```\n\nThe rendered prompt contains the sentinel from the project `AGENTS.md`.\n\nI also reproduced through a real non-interactive turn with `codex exec --strict-config --json --ephemeral`, an isolated `CODEX_HOME`, and the same exact normalized project path configured as `untrusted`; the model returned the sentinel instruction. No config file was persisted in the isolated home.\n\n### Expected\n\nProject-level `AGENTS.md` content is omitted when that exact project has `trust_level="untrusted"`, consistent with the 0.150.0 release note: “Untrusted projects no longer supply project-level `AGENTS.md` instructions.”\n\n### Actual\n\nProject-level `AGENTS.md` content is included in both `debug prompt-input` and the model-visible non-interactive turn.\n\n### Safety note\n\nThe reproducer uses only a disposable repository and a harmless sentinel. No private repository content or credentials are included.

Start with the codex debug prompt-input and codex exec --strict-config --json --ephemeral entry points and reproduce the issue using an isolated CODEX_HOME and disposable repository. Trace how trust_level="untrusted" affects project-level AGENTS.md loading during prompt construction. Done means the sentinel is absent from both prompt-input output and the model-visible non-interactive turn.