[codex] Allow socketpair in proxy-routed Linux sandbox (#26625)

## Summary

- allow `socketpair(AF_UNIX, ...)` in the proxy-routed Linux seccomp
mode
- continue denying `socket(AF_UNIX, ...)` so user commands cannot create
pathname or abstract Unix sockets
- extend the managed-proxy integration test to verify both behaviors

## Root cause

`NetworkSeccompMode::ProxyRouted` treated anonymous Unix socket pairs
like externally addressable Unix sockets and returned `EPERM`. This
breaks tools that use socket pairs for local child-process IPC even
though a socket pair cannot connect outside the sandbox or bypass the
routed proxy.

`dangerously_allow_all_unix_sockets` controls Unix-socket requests
forwarded by the managed network proxy; it does not currently configure
the Linux seccomp filter. Socket pairs should not require that dangerous
setting because they are unnamed, process-local IPC.

Related but independent: #26553 fixes host proxy bridge socket path
length handling.

---------

Co-authored-by: Codex <noreply@openai.com>

codex-rs/linux-sandbox/src/landlock.rs

@@ -217,10 +217,11 @@ fn install_network_seccomp_filter_on_current_thread(
         }
         NetworkSeccompMode::ProxyRouted => {
             // In proxy-routed mode we allow IP sockets in the isolated
-            // namespace (used to reach the local TCP bridge) but deny all
-            // other socket families, including AF_UNIX. This prevents
-            // bypassing the routed bridge via new Unix sockets and narrows the
-            // socket surface in proxy-only mode.
+            // namespace (used to reach the local TCP bridge) but deny socket()
+            // for all other families, including AF_UNIX. Only AF_UNIX
+            // socketpair() remains available for process-local IPC because it
+            // cannot connect to a socket outside the sandbox or bypass the
+            // bridge.
             let deny_non_ip_socket = SeccompRule::new(vec![
                 SeccompCondition::new(
                     0,
@@ -235,14 +236,14 @@ fn install_network_seccomp_filter_on_current_thread(
                     libc::AF_INET6 as u64,
                 )?,
             ])?;
-            let deny_unix_socketpair = SeccompRule::new(vec![SeccompCondition::new(
+            let deny_non_unix_socketpair = SeccompRule::new(vec![SeccompCondition::new(
                 0,
                 SeccompCmpArgLen::Dword,
-                SeccompCmpOp::Eq,
+                SeccompCmpOp::Ne,
                 libc::AF_UNIX as u64,
             )?])?;
             rules.insert(libc::SYS_socket, vec![deny_non_ip_socket]);
-            rules.insert(libc::SYS_socketpair, vec![deny_unix_socketpair]);
+            rules.insert(libc::SYS_socketpair, vec![deny_non_unix_socketpair]);
         }
     }