docs(codex): say what Allow network access leaves alone

The owner's answer to the PR's open question: the switch does not also pass
--sandbox workspace-write. Settings, wiki, skill and release note now state
the consequence: a folder Codex runs read-only keeps the network closed and
asks per command. A golden test pins the decision by name, and the stale
launch-defaults comments now name networkAccess.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/config/cli-registry/stock.ts

@@ -674,8 +674,9 @@ const CODEX: CliEntry = {
           // a live pane): loopback stays blocked under workspace-write until this is set.
           // ⚠️ Workspace-write ONLY: a folder codex runs read-only (one it does not trust,
           // such as a fresh non-git case) keeps the network closed and asks per command.
-          // Deliberately not paired with `--sandbox workspace-write`, which would also
-          // grant write access to a folder codex itself chose not to trust.
+          // Deliberately not paired with `--sandbox workspace-write` (owner decision,
+          // 2026-11-06), which would also grant write access to a folder codex itself chose
+          // not to trust, under a label that only says "network".
           {
             flag: '--config',
             value: 'sandbox_workspace_write.network_access=true',