Isolate external editor buffers from sandbox-writable paths (#38830)

## Why

External editor buffers can contain the current composer text and should not be
placed in directories exposed as writable by a restricted filesystem policy.

## What changed

- Create editor buffer files under a protected `editor` directory, trying the
  configured Codex home, the default Codex home, and a workspace fallback.
- Reject candidates that overlap writable roots or resolve through symbolic
  links, while preserving external editor support for full-disk-write policies.
- Surface an editor error when no protected directory is available.

## Testing

Add coverage for writable roots, aliases, symbolic links, fallback selection,
temporary-directory grants, full-disk-write policies, and editor invocation.

GitOrigin-RevId: df1029d81b327678991ab84ffd1077f0e5855631

codex-rs/tui/src/app/input.rs

@@ -107,8 +107,19 @@ impl App {
         };
 
         let seed = self.chat_widget.composer_text_with_pending();
+        let config = self.chat_widget.config_ref();
+        let file_system_policy = config.permissions.file_system_sandbox_policy();
         let editor_result = tui
-            .with_restored(|| async { external_editor::run_editor(&seed, &editor_cmd).await })
+            .with_restored(|| async {
+                external_editor::run_editor(
+                    &seed,
+                    &editor_cmd,
+                    config.codex_home.as_path(),
+                    &file_system_policy,
+                    config.cwd.as_path(),
+                )
+                .await
+            })
             .await;
         self.reset_external_editor_state(tui);