Use the numeric ioctl value in the macOS sandbox policy (#49028)

Older macOS policy compilers do not define the `TIOCSTI` symbol. Generate the sandbox CLI's Seatbelt deny rule with the numeric value from `libc::TIOCSTI` so it remains compatible while blocking terminal input injection.

GitOrigin-RevId: de8113fbab92bb399f37b9a22762c5c649f25972

codex-rs/cli/src/debug_sandbox.rs

@@ -413,7 +413,11 @@ async fn run_command_under_sandbox(
             // for the unsandboxed shell that resumes when Codex exits.
             match args.as_mut_slice() {
                 [flag, policy, ..] if flag.as_str() == "-p" => {
-                    policy.push_str("\n(deny file-ioctl (ioctl-command TIOCSTI))");
+                    // Older macOS policy compilers do not define the TIOCSTI symbol.
+                    policy.push_str(&format!(
+                        "\n(deny file-ioctl (ioctl-command {}))",
+                        libc::TIOCSTI
+                    ));
                 }
                 _ => anyhow::bail!("Seatbelt command is missing its generated policy"),
             }