Clarify workflow auth and network requirements

[Octane0411]

Problem statement

The workflow docs were underspecified for agent runs that need authenticated networked CLIs or external APIs.

Scope summary

• clarify that env vars are inherited but interactive login state and OS keychain access should not be assumed inside an agent turn
• show an explicit network-enabled codex.turn_sandbox_policy example
• update approval policy wording to point readers to the installed Codex schema

References

• local demo investigation against oas-demo
• Codex app-server local schema via codex app-server generate-json-schema
• upstream README guidance about Codex-owned sandbox fields

Validation

• git diff --check
• pnpm lint was not run in this worktree because node_modules is not present here; verified the doc diff manually instead