fix: warn when bwrap cannot create user namespaces

[viyatb-oai]

Summary

• suppress the missing-bubblewrap startup warning when sandboxing is intentionally bypassed with danger-full-access
• add a startup warning when system bwrap is present but cannot create user namespaces
• keep the Linux-specific probe and stderr matching in codex-sandboxing, with codex-core only handling the sandbox-policy gate

Details

• detects the known bubblewrap failures for RTM_NEWADDR, RTM_NEWLINK, uid-map permission denial, and No permissions to create a new namespace
• keeps this as a startup warning only; command execution still falls back to the existing sandbox behavior
• updates the Linux sandbox docs to call out the user-namespace requirement

Validation

• cargo test -p codex-sandboxing
• cargo test -p codex-core system_bwrap_warning_skips_danger_full_access --lib
• just fix -p codex-sandboxing
• just fmt
• just argument-comment-lint
• git diff --check origin/main...HEAD