Allow unrelated namespace mounts in Linux sandbox socket checks (#46535)

## Why

Namespace mounts can have roots such as `mnt:[inode]` or `net:[inode]` that are not filesystem paths. Treating every mount root as a path rejects these unrelated mounts and prevents sandbox startup.

## What changed

Parse mount roots as paths only for the daemon socket's filesystem. Continue validating every mount destination and checking mount ancestry, nested mounts, and socket aliases.

## Testing

Add regression cases for namespace mounts, invalid destinations, and socket aliases, both with and without a mount ID. Extend the socket-isolation integration fixture with an unrelated network namespace mount to exercise successful startup and rejection of a real socket alias.

GitOrigin-RevId: 9a1d2a69e5bd3f8d09b1de7cf998ee6d9c6bb980

codex-rs/linux-sandbox/tests/suite/daemon_sockets_tests.rs

@@ -65,6 +65,15 @@ fn private_tmp_fixture() {
     if !mount.status.success() {
         std::process::exit(/*code*/ 77);
     }
+    // Namespace mounts have non-path roots such as `net:[inode]`. An unrelated
+    // one must not stop startup or disable the socket-isolation checks below.
+    let namespace = "/tmp/network-namespace";
+    std::fs::File::create(namespace).unwrap();
+    let mount = std::process::Command::new("mount")
+        .args(["--bind", "/proc/self/ns/net", namespace])
+        .output()
+        .unwrap();
+    assert!(mount.status.success(), "{mount:?}");
     let root = codex_uds::prepare_shared_daemon_socket_directory().unwrap();
     let endpoint = root.join("rpc.sock");
     let _daemon = UnixListener::bind(&endpoint).unwrap();