feat: allow limited git writes in workspace sandbox

Co-authored-by: Codex noreply@openai.com

codex-rs/thread-store/src/local/read_thread.rs

@@ -846,6 +846,7 @@ mod tests {
         let legacy_policy = SandboxPolicy::WorkspaceWrite {
             writable_roots: Vec::new(),
             network_access: false,
+            allow_limited_git_writes: false,
             exclude_tmpdir_env_var: false,
             exclude_slash_tmp: false,
         };