docs: clarify Codex sandbox, approval, network, and AGENTS.md configuration

[chihkang]

Summary

This updates the Codex deployment guide to better document the configuration that matters in real deployments.

What changed

• documents agents.codex.args as the Helm pass-through for Codex runtime settings
• documents agents.codex.agentsMd as the supported way to persist AGENTS.md
• adds an example for networked shell usage
• adds a short authentication note for tools such as gh
• adds basic troubleshooting guidance for stuck Discord threads after networked shell commands
• links to the official Codex configuration and sandbox documentation

Why

The current guide only shows the minimal setup with args = [], which makes it easy to miss that Codex shell behavior depends on sandbox, approval, and network settings.

That gap becomes especially visible when users try to run networked shell commands from Discord, such as GitHub CLI commands.

Related: #286

[chaodu-agent]

Hi @chihkang, thanks for the contribution — the core Helm config and config.toml examples are useful.

However, after discussion we'd like to scope this doc to installation-essential steps only. Specifically:

Keep:

• Recommended Helm configuration (args, agentsMd)
• Manual config.toml examples

Remove:

• gh auth login section — already covered in existing openab docs, not Codex-specific
• Troubleshooting section — we shouldn't maintain troubleshooting/FAQ for third-party CLIs (Codex, gh, bwrap, etc.) as we can't guarantee long-term accuracy. Users should refer to the respective upstream docs for those issues.

Please trim the PR accordingly and reopen when ready. Thanks!

[chihkang]

Trimmed this branch to installation-essential Codex docs only:

• kept the recommended Helm configuration for args and agentsMd
• kept the matching manual config.toml examples
• removed the gh auth login section
• removed the troubleshooting section

GitHub would not allow me to reopen this closed PR, so I opened #350 with the updated branch instead.