Linux sandbox helper entry point.
On Linux, codex-linux-sandbox applies:
codex-linux-sandbox
no_new_privs