Force Codex to ask for permission in sandbox

Codex pro tip:

Add this rule to AGENTS.⁠md when it starts getting confused about commands in the sandbox to force it to ask for permission

(I got sick of it trying to troubleshoot why it couldn't add or commit files!)

---
When a shell command fails with “failed in sandbox”, use the permission request tool (with `with_escalated_permissions`) to ask the user for approval before retrying.