fix: follow up on linux sandbox review nits

[viyatb-oai]

Summary

• address the follow-up review nits from refactor: make bubblewrap the default Linux sandbox #13996 in a separate PR
• make the approvals test command a raw string and keep the managed-network path using env proxy routing
• inline --apply-seccomp-then-exec in the Linux sandbox inner command builder
• remove the bubblewrap-specific sandbox metric tag path and drop the use_legacy_landlock shim from sandbox_tag/TurnMetadataState::new
• restore the Feature import that origin/main currently still needs in connectors.rs

Testing

• cargo test -p codex-linux-sandbox
• focused codex-core tests were rerun/started, but the final verification pass was interrupted when I pushed at request