Verify Codex git commits on Linux sandbox #1161

On macOS, #1160 (commit 07aab234) makes Codex workspace-write able to git add/commit by listing the checkout gitdir (and linked-worktree objects/refs/logs) in sandbox_workspace_write.writable_roots. Linux bubblewrap is different: openai/codex#14338 and #19786 report that a later read-only bind mount on .git / gitdir: wins even when the path is in writable_roots, so git add fails with Read-only file system on index.lock.

Reproduce on Linux with Codex CLI: a standalone repo and a linked worktree, both outside /tmp, codex sandbox -c sandbox_mode=workspace-write with Solenta's computed writable_roots, then git add and git commit. If the RO mount still wins, implement a Linux-specific workaround (do not grant the whole common dir, which would make sibling worktree indexes writable) and extend electron/test/codex-git-sandbox.test.js so it fails closed on Linux instead of false-passing.

Filed from a Solenta suggested-work chip.