add support for -w,--writable-root to add more writable roots for sandbox (#263)

This adds support for a new flag, `-w,--writable-root`, that can be
specified multiple times to _amend_ the list of folders that should be
configured as "writable roots" by the sandbox used in `full-auto` mode.
Values that are passed as relative paths will be resolved to absolute
paths.

Incidentally, this required updating a number of the `agent*.test.ts`
files: it feels like some of the setup logic across those tests could be
consolidated.

In my testing, it seems that this might be slightly out of distribution
for the model, as I had to explicitly tell it to run `apply_patch` and
that it had the permissions to write those files (initially, it just
showed me a diff and told me to apply it myself). Nevertheless, I think
this is a good starting point.

codex-cli/tests/agent-terminate.test.ts

@@ -82,7 +82,14 @@ describe("Agent terminate (hard cancel)", () => {
   it("suppresses function_call_output and stops processing once terminate() is invoked", async () => {
     // Simulate a long‑running exec that would normally resolve with output.
     vi.spyOn(handleExec, "handleExecCommand").mockImplementation(
-      async (_args, _config, _policy, _getConf, abortSignal) => {
+      async (
+        _args,
+        _config,
+        _policy,
+        _additionalWritableRoots,
+        _getConf,
+        abortSignal,
+      ) => {
         // Wait until the abort signal is fired or 2s (whichever comes first).
         await new Promise<void>((resolve) => {
           if (abortSignal?.aborted) {
@@ -106,6 +113,7 @@ describe("Agent terminate (hard cancel)", () => {
       instructions: "",
       config: { model: "any", instructions: "" },
       approvalPolicy: { mode: "auto" } as any,
+      additionalWritableRoots: [],
       onItem: (item) => received.push(item),
       onLoading: () => {},
       getCommandConfirmation: async () => ({ review: "yes" } as any),
@@ -141,6 +149,7 @@ describe("Agent terminate (hard cancel)", () => {
       instructions: "",
       config: { model: "any", instructions: "" },
       approvalPolicy: { mode: "auto" } as any,
+      additionalWritableRoots: [],
       onItem: () => {},
       onLoading: () => {},
       getCommandConfirmation: async () => ({ review: "yes" } as any),