fix(core): emit unified exec sandbox denial lifecycle

[mldangelo-oai]

What

• Emit a failed unified-exec command lifecycle when sandbox setup is denied before process spawn.
• Add focused regression coverage for the pre-spawn sandbox-denial path.

Why

In the publicly released Codex app server surface, a unified-exec sandbox denial can become model-visible while the raw app-server stream omits the corresponding commandExecution lifecycle entirely. That leaves clients without the expected start/end execution signals for a failed command.

Reproduction

Observed against public codex-cli 0.130.0:

1. Start codex app-server with unified exec enabled.
2. Trigger a command that is denied during sandbox setup before spawn.
3. Inspect raw app-server notifications.
4. The model-visible denial is present, but the raw stream does not emit the expected item/started / failed item/completed command lifecycle.

Control case:

• Re-running the same probe with codex app-server --disable unified_exec emits the expected command lifecycle notifications.

Root cause

UnifiedExecProcessManager::exec_command(...) returns early on UnifiedExecError::SandboxDenied before emitting begin/end lifecycle notifications.

Fix

Emit a failed unified-exec lifecycle for that pre-spawn denial branch, preserving the denial result while keeping the app-server event stream consistent with other failed command paths.

Duplicate audit

Before opening this PR, I searched public issues and PRs for commandExecution, item/commandExecution/outputDelta, unified_exec, SandboxDenied, sandbox_apply, ExecCommandBegin, and ExecCommandEnd. I found adjacent context, but no exact public duplicate report or fix for this missing lifecycle path.

Validation

• cargo test -p codex-core failed_pre_spawn_sandbox_denial_emits_begin_and_end --lib
• cargo test -p codex-core failed_initial_end_for_unstored_process_uses_fallback_output --lib
• cargo fmt --check
• git diff --check
• just fmt
• just fix -p codex-core

Public bug-report evidence and repro notes were prepared before this PR so the behavior can be evaluated independently of the patch.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[mldangelo-oai]

I have read the CLA Document and I hereby sign the CLA