## Why
Nested writable roots must allow the Linux sandbox to start while preserving read-only metadata protections, including when a writable directory sits beneath a read-only `.codex` directory.
## What changed
Defer read-only subpath mounts shared with a deeper writable root until that root is bound. Keep symlink target remapping and writable-symlink validation for deferred paths so mount ordering does not bypass those checks.
## Testing
Add regression coverage for mounting `.git`, `.agents`, and `.codex` metadata exactly once after the nested writable bind. Add sandbox integration cases for ordinary and symlinked roots, using both parent and nested working directories, to verify startup, allowed writes, metadata protection, and temporary mountpoint cleanup.
GitOrigin-RevId: 45e439eaf537e10bfa8b839bad816b0401fb65aa
jif
8bbe8f8702