Codex can commit in a plain checkout: the driver makes the git dir writable

[suleimansh]

Codex's workspace-write sandbox keeps a .git/ directory at the workspace root read-only. So a Codex agent in a plain clone failed its first commit on .git/index.lock. Agent checkouts under .branches/ are git worktrees, so they never hit it.

• CodexSession.prompt() looks up the git common dir on every turn with git rev-parse --path-format=absolute --git-common-dir.
• Under workspace-write, the driver passes that dir as -c sandbox_workspace_write.writable_roots=[...].
• If the folder is not in a repository, or git is missing, nothing is added. read-only and danger-full-access are unchanged.
• extraArgs still come last, so a caller's own writable_roots replaces ours. The option's doc comment now says so.
• A writable git dir also lets the agent change hooks and git config. This is accepted: committing is the agent's job, and worktrees already allowed it.
• Two new tests cover a git init temp repo and the read-only sandbox. With the flag switched off, the repo test fails.
• codex.LOGIC.md and codex.test.LOGIC.md are updated.

Closes #1747

🤖 Generated with Claude Code

Opened from The Framework session codex-git-dir-writable.