pub fn validate(profile: &str) -> Result<(), String>
Compile the actual profile before launching Codex. No unsandboxed fallback.