Support sandboxed file streaming in exec-server (#38356)

## Why

Streaming reads previously rejected requests that used a platform filesystem
sandbox.

## What changed

- Open streamed files in the sandbox helper and return the open file to the
  exec-server by passing a file descriptor on Unix or duplicating a file handle
  on Windows.
- Advertise support through the `sandboxedFileStreaming` environment capability.
- Preserve close-on-exec behavior for transferred descriptors, including the
  required inherited-descriptor cleanup on macOS.

## Testing

- Cover bounded sandboxed streams, continued reads after path replacement, and
  rejection of symlink escapes outside readable roots.

GitOrigin-RevId: 677b2444b74e834b78b87a8554bc119c1c6e08b2

codex-rs/exec-server-protocol/src/protocol.rs

@@ -118,6 +118,9 @@ pub struct EnvironmentCapabilities {
     /// Whether this executor supports the `environmentConfig/read` request.
     #[serde(default)]
     pub environment_config_read: bool,
+    /// Whether filesystem streams can use the requested platform sandbox.
+    #[serde(default)]
+    pub sandboxed_file_streaming: bool,
 }
 
 /// Status returned by an initialized exec-server connection.
@@ -179,6 +182,7 @@ impl EnvironmentInfo {
                 network_proxy_launch: true,
                 capability_discovery_sandbox: true,
                 environment_config_read: true,
+                sandboxed_file_streaming: true,
             },
         }
     }
@@ -931,6 +935,7 @@ mod tests {
                 network_proxy_launch: true,
                 capability_discovery_sandbox: true,
                 environment_config_read: false,
+                sandboxed_file_streaming: false,
             }
         );
     }
@@ -945,6 +950,7 @@ mod tests {
                 "networkProxyLaunch": false,
                 "capabilityDiscoverySandbox": false,
                 "environmentConfigRead": false,
+                "sandboxedFileStreaming": false,
             },
         });
         let info: EnvironmentInfo = serde_json::from_value(expected.clone())