fix(sandboxing): reject WSL1 bubblewrap sandboxing (#17559)

## Summary

- detect WSL1 before Codex probes or invokes the Linux bubblewrap
sandbox
- fail early with a clear unsupported-operation message when a command
would require bubblewrap on WSL1
- document that WSL2 follows the normal Linux bubblewrap path while WSL1
is unsupported

## Why

Codex 0.115.0 made bubblewrap the default Linux sandbox. WSL1 cannot
create the user namespaces that bubblewrap needs, so shell commands
currently fail later with a raw bwrap namespace error. This makes the
unsupported environment explicit and keeps non-bubblewrap paths
unchanged.

The WSL detection reads /proc/version, lets an explicit WSL<version>
marker decide WSL1 vs WSL2+, and only treats a bare Microsoft marker as
WSL1 when no explicit WSL version is present.

addresses https://github.com/openai/codex/issues/16076

---------

Co-authored-by: Codex <noreply@openai.com>

codex-rs/sandboxing/src/manager.rs

@@ -1,3 +1,7 @@
+#[cfg(target_os = "linux")]
+use crate::bwrap::WSL1_BWRAP_WARNING;
+#[cfg(target_os = "linux")]
+use crate::bwrap::is_wsl1;
 use crate::landlock::CODEX_LINUX_SANDBOX_ARG0;
 use crate::landlock::allow_network_for_proxy;
 use crate::landlock::create_linux_sandbox_command_args_for_policies;
@@ -109,6 +113,8 @@ pub struct SandboxTransformRequest<'a> {
 #[derive(Debug)]
 pub enum SandboxTransformError {
     MissingLinuxSandboxExecutable,
+    #[cfg(target_os = "linux")]
+    Wsl1UnsupportedForBubblewrap,
     #[cfg(not(target_os = "macos"))]
     SeatbeltUnavailable,
 }
@@ -119,6 +125,8 @@ impl std::fmt::Display for SandboxTransformError {
             Self::MissingLinuxSandboxExecutable => {
                 write!(f, "missing codex-linux-sandbox executable path")
             }
+            #[cfg(target_os = "linux")]
+            Self::Wsl1UnsupportedForBubblewrap => write!(f, "{WSL1_BWRAP_WARNING}"),
             #[cfg(not(target_os = "macos"))]
             Self::SeatbeltUnavailable => write!(f, "seatbelt sandbox is only available on macOS"),
         }
@@ -219,6 +227,13 @@ impl SandboxManager {
                 let exe = codex_linux_sandbox_exe
                     .ok_or(SandboxTransformError::MissingLinuxSandboxExecutable)?;
                 let allow_proxy_network = allow_network_for_proxy(enforce_managed_network);
+                #[cfg(target_os = "linux")]
+                ensure_linux_bubblewrap_is_supported(
+                    &effective_file_system_policy,
+                    use_legacy_landlock,
+                    allow_proxy_network,
+                    is_wsl1(),
+                )?;
                 let mut args = create_linux_sandbox_command_args_for_policies(
                     os_argv_to_strings(argv),
                     command.cwd.as_path(),
@@ -256,6 +271,22 @@ impl SandboxManager {
     }
 }
 
+#[cfg(target_os = "linux")]
+fn ensure_linux_bubblewrap_is_supported(
+    file_system_sandbox_policy: &FileSystemSandboxPolicy,
+    use_legacy_landlock: bool,
+    allow_network_for_proxy: bool,
+    is_wsl1: bool,
+) -> Result<(), SandboxTransformError> {
+    let requires_bubblewrap = !use_legacy_landlock
+        && (!file_system_sandbox_policy.has_full_disk_write_access() || allow_network_for_proxy);
+    if is_wsl1 && requires_bubblewrap {
+        return Err(SandboxTransformError::Wsl1UnsupportedForBubblewrap);
+    }
+
+    Ok(())
+}
+
 fn os_argv_to_strings(argv: Vec<OsString>) -> Vec<String> {
     argv.into_iter()
         .map(os_string_to_command_component)