Add a macOS Seatbelt backend for sandbox integrity (#51841)

## What changed

Enable the exec server's `sandbox_integrity` module on macOS and select the Seatbelt backend. Inventory the Codex executable and the system Seatbelt executable as critical dependencies.

Preserve the filesystem sandbox policy unchanged: Seatbelt handles deny globs as native patterns, so no snapshot scan is needed.

GitOrigin-RevId: 78299dd61e168f5ce34454c8b3bb887e67c5f342

codex-rs/exec-server/src/lib.rs

@@ -41,7 +41,7 @@ mod rpc;
 mod rpc_server_requests;
 mod rpc_timing;
 mod runtime_options;
-#[cfg(any(target_os = "linux", target_os = "windows"))]
+#[cfg(any(target_os = "linux", target_os = "macos", target_os = "windows"))]
 #[expect(
     dead_code,
     reason = "The integrity runner is added later in this stack."

codex-rs/exec-server/src/sandbox_integrity/mod.rs

@@ -1,4 +1,5 @@
 #[cfg_attr(target_os = "linux", path = "bubblewrap.rs")]
+#[cfg_attr(target_os = "macos", path = "seatbelt.rs")]
 #[cfg_attr(target_os = "windows", path = "mxc.rs")]
 mod backend;
 mod dependencies;

codex-rs/exec-server/src/sandbox_integrity/seatbelt.rs

@@ -0,0 +1,37 @@
+//! Seatbelt keeps deny globs as native patterns; no snapshot scan is needed.
+
+use super::dependencies::Dependency;
+use super::dependencies::codex_executable;
+use codex_protocol::permissions::FileSystemSandboxPolicy;
+use codex_sandboxing::SandboxExecRequest;
+use codex_sandboxing::SandboxType;
+use codex_utils_absolute_path::AbsolutePathBuf;
+use std::io;
+use std::path::PathBuf;
+
+pub(super) const SANDBOX_TYPE: SandboxType = SandboxType::MacosSeatbelt;
+pub(super) const NAME: &str = "seatbelt";
+
+pub(super) fn critical_dependencies(
+    _request: &SandboxExecRequest,
+    _policy: &FileSystemSandboxPolicy,
+    _cwd: &AbsolutePathBuf,
+) -> io::Result<Vec<Dependency>> {
+    Ok(vec![
+        codex_executable(),
+        (
+            "seatbelt",
+            Ok(PathBuf::from(
+                codex_sandboxing::seatbelt::MACOS_PATH_TO_SEATBELT_EXECUTABLE,
+            )),
+        ),
+    ])
+}
+
+pub(super) fn prepare_policy(
+    _request: &SandboxExecRequest,
+    policy: FileSystemSandboxPolicy,
+    _cwd: &AbsolutePathBuf,
+) -> io::Result<FileSystemSandboxPolicy> {
+    Ok(policy)
+}