Fix daemon socket isolation checks for private tmp mounts (#46125)

## Why

Private `/tmp` bind mounts can leave hidden entries in `/proc/self/mountinfo`, causing the Linux sandbox to reject layouts that safely isolate daemon sockets. The proc-mount preflight also needs the main sandbox's WSL masks when checking aliases.

## What changed

- Identify the opened socket directory's mount using `fdinfo`, with a `statx` fallback, and follow its mount ancestry to distinguish hidden paths from exposed aliases.
- Accept safe private and stacked mounts while rejecting covered mounts, exposed aliases, and nested mounts. Retain conservative checks when no mount ID is available.
- Preserve WSL interop and WSLg masks in the proc-mount preflight.
- Heap-allocate large lifecycle futures in the TUI approval-gated MCP tool test to reduce Windows test-thread stack usage.

## Testing

Add mount-layout regression cases and a namespace integration test that verifies daemon sockets remain inaccessible under private `/tmp`, unrelated sockets remain reachable, and an exposed alias prevents startup. Add a preflight test for preserving WSL masks.

GitOrigin-RevId: 289b4446ba7776a7dd57ef5ff09e87bda19b069c

codex-rs/linux-sandbox/src/linux_run_main_tests.rs

@@ -326,16 +326,19 @@ fn managed_proxy_preflight_argv_unshares_network() {
         NetworkSandboxPolicy::Enabled,
         /*allow_network_for_proxy*/ true,
     );
-    let argv = build_preflight_bwrap_argv(mode)
-        .expect("build preflight argv")
-        .args;
+    let argv = build_preflight_bwrap_argv(BwrapOptions {
+        network_mode: mode,
+        ..Default::default()
+    })
+    .expect("build preflight argv")
+    .args;
     assert!(argv.iter().any(|arg| arg == "--"));
     assert!(argv.iter().any(|arg| arg == "--unshare-net"));
 }
 
 #[test]
 fn proc_mount_preflight_does_not_bind_the_full_filesystem() {
-    let argv = build_preflight_bwrap_argv(BwrapNetworkMode::FullAccess)
+    let argv = build_preflight_bwrap_argv(BwrapOptions::default())
         .expect("build preflight argv")
         .args;
 
@@ -349,6 +352,34 @@ fn proc_mount_preflight_does_not_bind_the_full_filesystem() {
     assert!(!argv.windows(3).any(|window| window == ["--bind", "/", "/"]));
 }
 
+#[test]
+fn proc_mount_preflight_preserves_wsl_masks() {
+    let argv = build_preflight_bwrap_argv(BwrapOptions {
+        mask_wsl_interop: true,
+        mask_wslg_distro: true,
+        ..Default::default()
+    })
+    .expect("build WSL preflight argv")
+    .args;
+
+    assert!(argv.windows(2).any(|window| window == ["--proc", "/proc"]));
+    assert!(
+        argv.windows(2)
+            .any(|window| window == ["--tmpfs", WSL_INTEROP_DIR])
+    );
+    assert!(argv.windows(6).any(|window| {
+        window
+            == [
+                "--perms",
+                "000",
+                "--tmpfs",
+                WSLG_DISTRO_ROOT,
+                "--remount-ro",
+                WSLG_DISTRO_ROOT,
+            ]
+    }));
+}
+
 #[test]
 fn cleanup_synthetic_mount_targets_removes_only_empty_mount_targets() {
     let temp_dir = tempfile::TempDir::new().expect("tempdir");