exec-server: expose fs helper alias roots

[starr-openai]

Summary

• allow the sandboxed filesystem helper to read both the real Codex binary parent and the codex-linux-sandbox arg0 alias parent
• update Docker remote-env sandbox contexts to use a cwd that exists inside the remote container
• add coverage that the helper runtime permission roots include the Linux sandbox alias parent

Comparison with #19016

This is a smaller alternate to #19016. Both patches address the same two failure modes: the fs helper sandbox needs the arg0 alias parent, and the Docker remote-env tests must not send a host checkout cwd to the remote exec-server.

#19016 is broader: it moves cwd-dependency detection into the exec-server filesystem module, strips unused cwd values in the remote filesystem client for all remote fs calls, and adds transport-level unit coverage. This PR keeps the cwd fix local to the Docker remote-env tests, so it is narrower but less general. If the goal is product runtime hardening, #19016 looks more complete; this branch is the minimal repro/CI fix.

Verification

• just fmt
• cargo test -p codex-core --test all suite::remote_env::remote_test_env_sandboxed_read_allows_readable_root -- --exact --nocapture on Applied devbox Docker remote-env: passed
• cargo test -p codex-core --test all remote_test_env -- --nocapture on Applied devbox Docker remote-env: 5 passed