[codex] Add generic sandbox command execution

[winrey]

Summary

• Add aHand generic sandbox exec types and daemon APIs.
• Wire runtime provider aggregation and executable alias preservation for sandbox commands.
• Align macOS sandbox argv handling and update sandbox smoke coverage.

Validation

• cargo test -p ahandd
• cargo fmt --check