Resolve workspace permissions at the sandbox launch boundary (#59530)

## What changed

Add optional executor workspace roots to `SandboxTransformRequest` and resolve symbolic workspace rules after merging additional permissions. Preserve explicit deny rules and treat an empty root list as granting no workspace access.

Route Windows restricted-token preparation through the shared transform path and use explicit roots when building its direct-spawn wrapper. Update Windows MXC debug launches to bind configured roots before adding the managed CA read grant.

## Testing

Extend sandbox manager tests to cover workspace and subpath expansion, empty root lists, deny preservation, and the roots and write permissions serialized into the Windows wrapper.

GitOrigin-RevId: 0bebdb08b67cbbc182c18b031b9d13a21a799682

codex-rs/exec-server/src/fs_sandbox.rs

@@ -191,6 +191,7 @@ impl FileSystemSandboxRunner {
                 transform: SandboxTransformRequest {
                     command,
                     permissions: permission_profile,
+                    workspace_roots: None,
                     sandbox,
                     enforce_managed_network: false,
                     environment_id: None,

codex-rs/exec-server/src/process_sandbox.rs

@@ -311,6 +311,7 @@ pub(crate) async fn prepare_exec_request_with_telemetry(
                 additional_permissions: None,
             },
             permissions: &permissions,
+            workspace_roots: None,
             sandbox,
             enforce_managed_network: params.enforce_managed_network,
             environment_id: None,