We had existing logic that would check to see if arg0 is "codex-linux-sandbox", and if so, delegate to run_main() in the codex-linux-sandbox, which would set up the sandbox rules and then exec(3) the command to run under the sandbox:

This arg0 helper lived in the codex-linux-sandbox, but as it is a generally useful mechanism, it should be in its own crate, so this PR introduces the codex-arg0 crate and moves the code there. (I considered moving it into codex-common, but that ran the risk of circular dependencies, so it seemed easiest to move it into its own crate.)

This also enables us to tighten up some the dependencies for the codex-linux-sandbox crate, as now it has no [dependencies] section, as everything is now scoped to [target.'cfg(target_os = "linux")'.dependencies].

Stack created with Sapling. Best reviewed with ReviewStack.

• fix: run apply_patch calls through the sandbox #1705
• chore: split apply_patch logic out of codex.rs and into apply_patch.rs #1703
• fix: support special --codex-run-as-apply-patch arg #1702
• fix: use std::env::args_os instead of std::env::args #1698
• -> fix: move arg0 handling out of codex-linux-sandbox and into its own crate #1697