fix: enable GitHub-hosted Linux bubblewrap support

[viyatb-oai]

Summary

• enable unprivileged user namespaces on GitHub-hosted Linux runners during Codex setup, regardless of the requested sandbox mode
• clear the Ubuntu AppArmor userns gate when present so bubblewrap can bring up loopback
• document that this also covers workflows that bootstrap Codex once and invoke codex in later steps

Testing

• yq eval '.' action.yml >/dev/null
• git diff --check -- action.yml README.md

Fixes #75

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[bolinfest]

recheck

[viyatb-oai]

I have read the CLA Document and I hereby sign the CLA.

[bolinfest]

tysm for the quick fix!