Fail fast on unsupported Codex Podman sandbox

[KeyffMS]

Summary

Hardens the trusted live Codex qualification path after run #3 showed that Codex model access worked but every capability was blocked by the Linux command sandbox failing with bwrap: setting up uid map: Operation not permitted.

Changes

• require the full Linux qualification job to find the system bubblewrap package;
• run a direct bwrap user-namespace probe before any C01-C16 work;
• fail with a targeted error in seconds when the outer Podman/host namespace policy cannot support the inner Codex sandbox;
• keep the existing approval and filesystem sandbox boundaries; no danger-full-access or approvals/sandbox bypass is introduced;
• update actions/upload-artifact to the immutable v6 SHA (node24);
• document the Podman nested user-namespace prerequisite and diagnostic command;
• add a regression test pinning the preflight and Node 24 artifact action.

The self-hosted Codex workflow remains workflow_dispatch only and does not run on this PR.