refactor: make bubblewrap the default Linux sandbox (#13996)

## Summary
- make bubblewrap the default Linux sandbox and keep
`use_legacy_landlock` as the only override
- remove `use_linux_sandbox_bwrap` from feature, config, schema, and
docs surfaces
- update Linux sandbox selection, CLI/config plumbing, and related
tests/docs to match the new default
- fold in the follow-up CI fixes for request-permissions responses and
Linux read-only sandbox error text

codex-rs/core/config.schema.json

@@ -480,7 +480,7 @@
             "unified_exec": {
               "type": "boolean"
             },
-            "use_linux_sandbox_bwrap": {
+            "use_legacy_landlock": {
               "type": "boolean"
             },
             "voice_transcription": {
@@ -1985,7 +1985,7 @@
         "unified_exec": {
           "type": "boolean"
         },
-        "use_linux_sandbox_bwrap": {
+        "use_legacy_landlock": {
           "type": "boolean"
         },
         "voice_transcription": {