Native Codex PR review can bypass nested Bubblewrap with approvals retained

Observation (2026-09-08 UTC, local Codex CLI 0.149.0 in the Shield/theft worktree): a required native codex review --base failed inside a nested workspace-write sandbox because Bubblewrap could not initialize its loopback namespace. After explicit user authorization, rerunning the delegated native reviewer with --sandbox danger-full-access --ask-for-approval on-request through an approved outer execution path completed with exit status 0 while preserving review-only instructions and a clean worktree. Revalidate exact base/head SHAs immediately before the retry and keep literal output redaction. This supersedes the earlier same-session candidate that reported the review as unavailable; retaining on-request was the narrower successful configuration than pairing full access with approvals disabled. Provenance: native CLI execution and post-run git SHA/status checks; official Codex CLI reference for supported sandbox/approval flags.