docs(codex): say what Allow network access leaves alone

The owner's answer to the PR's open question: the switch does not also pass
--sandbox workspace-write. Settings, wiki, skill and release note now state
the consequence: a folder Codex runs read-only keeps the network closed and
asks per command. A golden test pins the decision by name, and the stale
launch-defaults comments now name networkAccess.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/types/session.ts

@@ -439,8 +439,10 @@ export interface CodexConfig {
   dangerouslyBypassApprovals?: boolean;
   /**
    * Let commands in codex's workspace-write sandbox use the network, Codeman's loopback API
-   * included (passes --config sandbox_workspace_write.network_access=true). Filled from the
-   * synced `codexNetworkAccess` setting when unset; clamped off for a non-granted owner.
+   * included (passes --config sandbox_workspace_write.network_access=true). Never changes the
+   * sandbox mode: a folder codex runs read-only keeps the network closed and asks per command.
+   * Filled from the synced `codexNetworkAccess` setting when unset; clamped off for a
+   * non-granted owner.
    */
   networkAccess?: boolean;
   /** Enable Codex's decorative TUI animations. Disable to reduce remote terminal redraws. */