Approve the independently verified Codex host sandbox diagnostic

Changes: Accept S00-031 with independent QA evidence and handoff; confirm the automation guidance matches the bounded host-context diagnostic.
Validation: Approved host stat verified uid1000/mode0700; inner workspace-write probe exited 0 with project write/read/remove and outside write denial EROFS30. make check passed 72 tests; scope, executor message and git diff --check passed. No model or storage task ran; acceptance covers this host/version and one filesystem boundary.
