feat(run_in_container): optionally mount ~/.codex so Linux users keep configs & logs

[braun-viathan]

What problem does this solve?

• On Linux Codex runs inside scripts/run_in_container.sh.
  Inside the container Codex looks for configs at /home/node/.codex (instructions, approval presets, session logs).
  Because the host $HOME/.codex is not bind‑mounted today, every container start loses those files — users cannot persist settings or share them between runs. 

Proposed solution

1. Add a conditional bind mount in run_in_container.sh

   if [[ -e "$HOME/.codex" ]]; then
     docker_flags+=("-v" "$HOME/.codex:/home/node/.codex:ro")
   fi```
   
        *No directory ⇒ no mount ⇒ zero breakage.*

2. Allow an override flag --config PATH so power‑users can point to an alternative folder/file (future‑proof for dot‑file minimalists). ([GitHub][1])
3. Keep the mount read‑only; the container already writes logs under /home/node/.codex/log, which is safe. ([GitHub][2])

Relationship to #781 / #783

• PR fix(run_in_container): drop hardcoded --full-auto flag #783 has removed the hard‑coded --full-auto flag, which is a prerequisite — otherwise the wrapper would still ignore CLI flags stored in config.json. ([GitHub][3])
• This feature branch will be rebased onto main after fix(run_in_container): drop hardcoded --full-auto flag #783 is merged.

Why now?

• Numerous issues show that users customise approvalMode, safeCommands, etc., via config.json. (e.g. bug: ECONNREFUSED when using run_in_container #480, Container script firewall is overly restrictive #376, feat: command whitelists #511) ([GitHub][4], [GitHub][2], [GitHub][5])
• Mounting is a five‑line change that removes an entire class of “Codex forgets my settings” tickets and aligns Linux with macOS behaviour. ([GitHub][6])

Acceptance criteria

• run_in_container.sh mounts $HOME/.codex when present.
• Codex inside the container loads the user’s config.json and shows the chosen approval mode in the banner.
• Script behaves exactly as before when the directory is absent.
• New Vitest e2e verifies that a temp config file becomes visible inside the container. (Tests folder already exists ([npm][7]))

Checklist

• implementation
• unit / e2e test
• README “Linux sandbox” section updated
• passes pnpm test && pnpm lint && pnpm typecheck

Happy to submit the accompanying PR once #783 lands. 🚀