refactor(codex): extract config building and support CLI overrides in remote mode

This refactoring introduces CLI argument overrides for sandbox and approval policy settings in remote mode, allowing users to specify security constraints via `--sandbox` and `--ask-for-approval` flags.

Changes:
- Add `CodexCliOverrides` type and `parseCodexCliOverrides()` utility to parse CLI flags like `--sandbox`, `-s`, `--ask-for-approval`, `-a`, along with convenience flags (`--full-auto`, `--dangerously-bypass-approvals-and-sandbox`)
- Extract complex start config building logic into `buildCodexStartConfig()` function with proper approval policy and sandbox resolution based on permission mode
- Thread `codexCliOverrides` through the session/loop/launcher chain and apply overrides only when permission mode is 'default'
- Update `codexRemoteLauncher` to use the new config builder and display appropriate warnings based on whether overrides are present
- Add comprehensive tests for both parsing and config building functions

cli/src/codex/session.ts

@@ -2,9 +2,11 @@ import { ApiClient, ApiSessionClient } from '@/lib';
 import { MessageQueue2 } from '@/utils/MessageQueue2';
 import { AgentSessionBase } from '@/agent/sessionBase';
 import type { EnhancedMode } from './loop';
+import type { CodexCliOverrides } from './utils/codexCliOverrides';
 
 export class CodexSession extends AgentSessionBase<EnhancedMode> {
     readonly codexArgs?: string[];
+    readonly codexCliOverrides?: CodexCliOverrides;
 
     constructor(opts: {
         api: ApiClient;
@@ -16,6 +18,7 @@ export class CodexSession extends AgentSessionBase<EnhancedMode> {
         onModeChange: (mode: 'local' | 'remote') => void;
         mode?: 'local' | 'remote';
         codexArgs?: string[];
+        codexCliOverrides?: CodexCliOverrides;
     }) {
         super({
             api: opts.api,
@@ -35,6 +38,7 @@ export class CodexSession extends AgentSessionBase<EnhancedMode> {
         });
 
         this.codexArgs = opts.codexArgs;
+        this.codexCliOverrides = opts.codexCliOverrides;
     }
 
     sendCodexMessage = (message: unknown): void => {