fix: gate remote-mount edit guidance by mode

[matthewflint]

Summary

• Build remote-mount edit guidance from the actual mount modes.
• Emit direct apply_patch and shell copy-back guidance only when at least one remote mount is read+write.
• Explicitly tell agents not to edit read-only remote mount paths in place, including with apply_patch, and not to write edited files back to those paths.
• Add regression coverage for read-only-only, read+write-only, mixed read-only/read+write manifests, and runtime policy injection.

Test plan

• UV_CACHE_DIR=/tmp/uv-cache UV_PROJECT_ENVIRONMENT=/tmp/openai-pr3423-venv UV_PYTHON=3.12.13 make format
• UV_CACHE_DIR=/tmp/uv-cache UV_PROJECT_ENVIRONMENT=/tmp/openai-pr3423-venv UV_PYTHON=3.12.13 make lint
• UV_CACHE_DIR=/tmp/uv-cache UV_PROJECT_ENVIRONMENT=/tmp/openai-pr3423-venv UV_PYTHON=3.12.13 make typecheck
• UV_CACHE_DIR=/tmp/uv-cache UV_PROJECT_ENVIRONMENT=/tmp/openai-pr3423-venv UV_PYTHON=3.12.13 make tests

Issue number

N/A

Checks

• I've added new tests (if relevant)
• I've added/updated the relevant documentation (N/A; generated sandbox policy text only)
• I've run make lint and make format
• I've made sure tests pass

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2736b84b00

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[matthewflint]

Updated this to gate remote-mount edit guidance by mount mode.

Direct apply_patch and shell copy-back guidance now only appears when a read+write remote mount is present. Read-only mounts now explicitly say not to edit those paths in place, including with apply_patch, and not to write edited files back.

Added regression coverage for read-only-only, read+write-only, mixed remote mount manifests, and runtime policy injection.

Checked locally with:

• make format
• make lint
• make typecheck
• make tests