Consume generated Odoo workspaces safely

[cbusillo]

Summary

• add repeatable --workspace-root support for exact workspace-write roots across exec, interactive, and native child-session startup
• reject ambiguous or unsafe combinations with --add-dir, non-workspace sandboxes, and dangerous sandbox bypass
• add a fail-closed Odoo workspace adapter that consumes platform workspace status --check, verifies exact Codex Lab provenance, and records launch evidence
• extend the exec harness with deterministic external sources, non-Git workspaces, symlinks, exact writable roots, and resume coverage
• prove canonical guide loading plus tenant/devkit writes while generated-root, managed-source, and outside writes remain denied

Design Note

The issue originally proposed passing editable roots through --add-dir. That keeps the launch CWD writable, which is too broad for generated workspaces. This change adds a generic exact-root primitive instead; Odoo detection and provider authority remain isolated in the adapter/harness layer.

Validation

• just fmt
• python3 -m unittest discover -s tools/codex-exec-harness -p 'test_*.py' — 111 passed
• cargo test -p codex-utils-cli -p codex-prompts --lib — 52 passed
• cargo test -p codex-core explicit_workspace_roots_replace_cwd_for_workspace_write -- --nocapture
• cargo test -p codex-core session_permission_profile_rebinds_exact_runtime_workspace_roots -- --nocapture
• deterministic generated-odoo-workspace-consumption scenario against the clean candidate
• exact binary/source provenance verified at 42d8c7be84612871de479ca2db0d6c616fc169e1
• real CM generated workspace dry-run passed with only status-declared editable roots

Safety Review

• dangerous bypass, prompt option injection, editable/read-only overlap, symlinked notes, parent guidance contamination, and Git-worktree contamination all fail closed
• independent correctness and security reviews were incorporated before opening this PR

Closes #360