test(sandbox): add deny-read smoke helper

Co-authored-by: Codex <noreply@openai.com>

Author: viyatb-oai

codex-rs/linux-sandbox/README.md

@@ -78,6 +78,9 @@ commands that would enter the bubblewrap path.
   "**/*.env" = "none"
   ```
 
+  `glob_scan_max_depth` uses `rg --max-depth` semantics relative to the static
+  prefix before the first glob, so file path components count toward the limit.
+
 - When bubblewrap is active, symlink-in-path and non-existent protected paths inside
   writable roots are blocked by mounting `/dev/null` on the symlink or first
   missing component.

codex-rs/linux-sandbox/src/bwrap.rs

@@ -912,6 +912,8 @@ fn collect_glob_files(
     remaining_depth: Option<usize>,
     paths: &mut Vec<AbsolutePathBuf>,
 ) -> Result<()> {
+    // Keep the fallback aligned with `rg --max-depth`: the limit is measured
+    // from the static search root and includes the matched file component.
     for entry in fs::read_dir(dir)? {
         let entry = entry?;
         let path = entry.path();