macOS: Codex browser control via Chrome extension fails at startup — `node_repl` exits (code 65) with `sandbox-exec: unbound variable: TIOCSTI`

### Title


### Summary
When starting browser control from the Codex desktop app on macOS using the ChatGPT Chrome extension (`@Chrome`), the browser-control kernel (`node_repl`) exits immediately with code 65 before any connection to Chrome/DevTools is established. Resetting the browser-control session and retrying does not help.

### Environment
- Product/surface: Codex in ChatGPT desktop app (macOS)
- Browser integration: Chrome via browser extension (`@Chrome`)
- Codex app version: 26.908.70816 (Released Sep 14, 2026)
- OS: macOS [please fill in version, e.g. 15.1.1]
- Chrome version: [please fill in]
- Extension installed: ChatGPT browser extension (Chrome)
- Session ID (from `/feedback`): 01a0aa7e-d992-7b10-963c-4f9d75089f7a

### Steps to reproduce
1. Open the ChatGPT/Codex desktop app on macOS.
2. Ensure Chrome is running with the ChatGPT browser extension installed/enabled.
3. Open any website in Chrome (issue occurs regardless of site; happens before site interaction).
4. In a Codex chat, start a browser task using `@Chrome` (attempt to inspect/control the current Chrome session).
5. Observe the browser-control startup failure.

### Expected behavior
Codex connects to Chrome (extension + DevTools/inspection) and can inspect/operate the active tab.

### Actual behavior
Browser control fails immediately during startup, before Chrome is reached/connected.

### Error output
```text
node_repl kernel exited unexpectedly

kernel_status: exited(code=65)
sandbox-exec: unbound variable: TIOCSTI

Troubleshooting attempted

• Reset the browser-control session
• Retried the connection multiple times
• Confirmed the failure occurs before any website interaction

Additional notes / hypothesis

It looks like the generated sandbox-exec configuration may be referencing TIOCSTI as an unset shell variable, causing the sandboxed node_repl kernel to exit before connecting to Chrome.

Logs (optional)

If useful, I can attach the relevant macOS app logs from:
~/Library/Logs/com.openai.codex/YYYY/MM/DD
(Reviewed first for sensitive information.)

Reproduce the @Chrome startup sequence on macOS, then inspect the node_repl failure and logs under ~/Library/Logs/com.openai.codex/YYYY/MM/DD. Trace how sandbox-exec handles the TIOCSTI reference before the Chrome/DevTools connection; done means node_repl stays running and browser control connects successfully.