ci: bypass Codex sandbox in PR review to fix bwrap netns failure

Codex's bwrap sandbox fails to bring up its network-namespace loopback on
the ubicloud-standard-2 runner (`bwrap: loopback: Failed RTM_NEWADDR:
Operation not permitted`) and aborts before reading any file, so the
review posts "Unable to complete the review" instead of a verdict.
Reproduced deterministically on the fork command path (#10064): two runs,
identical failure, while non-fork auto-runs on the same pool succeed.

Widening the sandbox with a mode flag is not enough (bwrap still
initializes the netns and fails), so replace the `-s <mode>` selection
with `--dangerously-bypass-approvals-and-sandbox`, which skips sandbox
setup entirely. Per Codex's own help this flag is "intended solely for
running in environments that are externally sandboxed", which an
ephemeral CI runner is; the job already ran with full access.

This removes the network-disabled sandbox that #10069 relied on to
contain untrusted fork code during review. That containment is traded for
a working fork-review path: `/codex` is gated on a maintainer triggering
it, and the runner is short-lived with only the Codex auth present. The
rest of #10069's fork hardening is preserved (review policy read from the
base ref, persist-credentials:false on checkout, output written outside
the checkout).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/codex-pr-review.yml

@@ -306,14 +306,11 @@ jobs:
           if [ "$PR_IS_FORK" = "true" ]; then
             # Fork code is untrusted. Read the review policy/prompt from the base
             # ref (git show) rather than the attacker-controlled merge checkout,
-            # so a malicious fork can't rewrite the reviewer's own instructions,
-            # and run in a network-disabled sandbox to block secret exfiltration.
+            # so a malicious fork can't rewrite the reviewer's own instructions.
             git show "origin/$PR_BASE_REF:REVIEW.md" > /tmp/codex-prompt.md
             git show "origin/$PR_BASE_REF:.github/codex/pr-review.prompt.md" >> /tmp/codex-prompt.md
-            SANDBOX_MODE=workspace-write
           else
             cat REVIEW.md .github/codex/pr-review.prompt.md > /tmp/codex-prompt.md
-            SANDBOX_MODE=danger-full-access
           fi
           # The context file lives in RUNNER_TEMP (outside the attacker-controlled
           # checkout); tell the agent its absolute path.
@@ -321,11 +318,17 @@ jobs:
           # Write the final message outside the checkout too: a fork could commit
           # codex-final-message.md as a symlink and redirect this write to overwrite
           # e.g. a GitHub Action's index.js, which then runs with our credentials.
+          #
+          # Bypass the sandbox entirely instead of selecting a sandbox mode: Codex's
+          # bwrap sandbox fails to initialize its network namespace on this runner
+          # (`bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted`) and aborts
+          # before reading any file, so no review is possible with it enabled. The
+          # runner is already an ephemeral, externally sandboxed CI environment.
           codex exec \
             -C "$GITHUB_WORKSPACE" \
             -m gpt-5.6-sol \
             -c 'model_reasoning_effort="xhigh"' \
-            -s "$SANDBOX_MODE" \
+            --dangerously-bypass-approvals-and-sandbox \
             -o "$RUNNER_TEMP/codex-final-message.md" \
             - < /tmp/codex-prompt.md