Install bubblewrap for Codex sessions

[murrayju]

Summary

• install system bubblewrap in the sandbox base image
• document that Codex sessions now use /usr/bin/bwrap in ox sandboxes

Testing

• ./bun run check

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Ox Agent seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Copilot]

Pull request overview

Installs bubblewrap in the sandbox base Docker image and updates documentation to note that Codex can use /usr/bin/bwrap to avoid the vendored fallback warning.

Changes:

• Add bubblewrap to sandbox/base.Dockerfile apt packages.
• Document Codex’s use of system bwrap to suppress the vendored-bubblewrap warning.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
sandbox/base.Dockerfile	Installs bubblewrap in the Docker sandbox base image.
docs/agents.md	Documents that Codex can use /usr/bin/bwrap in ox sandboxes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This sentence starts a new paragraph/sentence after the previous period, but begins with lowercase "ox's". Capitalize it (e.g., "Ox's") or format the CLI name consistently (e.g., "ox's").

Suggested change

	ox's sandbox image installs system `bubblewrap`, so Codex can use `/usr/bin/bwrap`
	`ox`'s sandbox image installs system `bubblewrap`, so Codex can use `/usr/bin/bwrap`

[Copilot]

This note reads like it applies to all ox sandboxes, but only the Docker base image is updated in this PR. Cloud sandboxes are built via sandbox/cloud-base-steps.yaml (which currently doesn't install bubblewrap), so Codex sessions on the cloud provider may still lack /usr/bin/bwrap and show the warning. Please either scope the docs to the Docker provider/base image or ensure the cloud base snapshot also installs bubblewrap.

Suggested change

	ox's sandbox image installs system `bubblewrap`, so Codex can use `/usr/bin/bwrap`
	without printing its vendored-bubblewrap fallback warning at session startup.
	In Docker-based sandboxes, ox's base image installs system `bubblewrap`, so Codex can use `/usr/bin/bwrap`
	without printing its vendored-bubblewrap fallback warning at session startup. Other sandbox providers may not have `/usr/bin/bwrap` available and can still show this warning.