fix: use directory-backed root Codex config

[spalladino]

Uses a real root .codex directory whose entries link to the canonical .claude configuration.
This avoids writable-workspace sandbox failures caused by a symlinked .codex root and enforces the compatible layout.

[spalladino]

I asked a Terra to red/green this to confirm:

Confirmed directly: PR 25486 fixes a real, currently reproducible Codex sandbox failure.

• Red: I temporarily restored .codex -> .claude and ran ordinary sandboxed pwd. Bubblewrap failed exactly as reported:

  Fatal error: cannot enforce sandbox read-only path …/.codex because it crosses writable symlink …/.codex

• Green: I restored PR 25486’s real .codex/ directory with child symlinks and reran the identical command. It succeeded.

The older matching fix is merged [PR #23593](#23593), which documented the same error and converted component-level .codex symlinks. It omitted the repository root; #25486 closes that remaining case.