Preserve sandbox errors during session initialization (#40381)

## Why

On macOS, rejecting a symlinked writable root during sandbox setup could be
misreported as corrupt session data because both paths surfaced an
`InvalidInput` I/O error.

## What changed

- Treat only `InvalidData` errors as evidence of corrupt session storage.
- Preserve `InvalidInput` failures so the original sandbox preparation error
  and its actionable details reach the user.

## Testing

Add a macOS regression test that configures a symlinked writable root and
verifies thread creation reports the sandbox failure without suggesting that
session data is corrupt.

GitOrigin-RevId: 2b83d9f92a517407b88c21b471fa8bff5fd20d1d

codex-rs/core/src/session_rollout_init_error.rs

@@ -50,7 +50,7 @@ fn map_rollout_io_error(io_err: &std::io::Error, codex_home: &Path) -> Option<Co
             "Session storage path {} is blocked by an existing file. Remove or rename it so Codex can create sessions.",
             sessions_dir.display()
         ),
-        ErrorKind::InvalidData | ErrorKind::InvalidInput => format!(
+        ErrorKind::InvalidData => format!(
             "Session data under {} looks corrupt or unreadable. Clearing the sessions directory may help (this will remove saved threads).",
             sessions_dir.display()
         ),