Suppress bwrap warning when sandboxing is bypassed (#16667)

Addresses #15282

Problem: Codex warned about missing system bubblewrap even when
sandboxing was disabled.

Solution: Gate the bwrap warning on the active sandbox policy and skip
it for danger-full-access and external-sandbox modes.

codex-rs/sandboxing/src/bwrap.rs

@@ -1,12 +1,24 @@
+use codex_protocol::protocol::SandboxPolicy;
 use std::path::Path;
 use std::path::PathBuf;
 
 const SYSTEM_BWRAP_PROGRAM: &str = "bwrap";
 
-pub fn system_bwrap_warning() -> Option<String> {
+pub fn system_bwrap_warning(sandbox_policy: &SandboxPolicy) -> Option<String> {
+    if !should_warn_about_system_bwrap(sandbox_policy) {
+        return None;
+    }
+
     system_bwrap_warning_for_lookup(find_system_bwrap_in_path())
 }
 
+fn should_warn_about_system_bwrap(sandbox_policy: &SandboxPolicy) -> bool {
+    !matches!(
+        sandbox_policy,
+        SandboxPolicy::DangerFullAccess | SandboxPolicy::ExternalSandbox { .. }
+    )
+}
+
 fn system_bwrap_warning_for_lookup(system_bwrap_path: Option<PathBuf>) -> Option<String> {
     match system_bwrap_path {
         Some(_) => None,

codex-rs/sandboxing/src/lib.rs

@@ -22,7 +22,9 @@ pub use manager::get_platform_sandbox;
 use codex_protocol::error::CodexErr;
 
 #[cfg(not(target_os = "linux"))]
-pub fn system_bwrap_warning() -> Option<String> {
+pub fn system_bwrap_warning(
+    _sandbox_policy: &codex_protocol::protocol::SandboxPolicy,
+) -> Option<String> {
     None
 }