fix: allow authorized Harness sandbox fallback

scripts/execute.py

@@ -66,6 +66,8 @@ class StepExecutor:
     """Phase 디렉토리 안의 step들을 순차 실행하는 하네스."""
 
     MAX_RETRIES = 3
+    CODEX_SANDBOX_ENV = "FESA_HARNESS_CODEX_SANDBOX"
+    CODEX_SANDBOX_MODES = frozenset({"workspace-write", "danger-full-access"})
     FEAT_MSG = "feat({phase}): step {num} - {name}"
     CHORE_MSG = "chore({phase}): step {num} output"
     TZ = timezone(timedelta(hours=9))
@@ -242,6 +244,15 @@ class StepExecutor:
 
     # --- Codex 호출 ---
 
+    def _codex_sandbox_mode(self) -> str:
+        mode = os.environ.get(self.CODEX_SANDBOX_ENV, "workspace-write")
+        if mode not in self.CODEX_SANDBOX_MODES:
+            allowed = ", ".join(sorted(self.CODEX_SANDBOX_MODES))
+            raise CodexEnvironmentError(
+                f"{self.CODEX_SANDBOX_ENV} must be one of: {allowed}"
+            )
+        return mode
+
     def _invoke_codex(self, step: dict, preamble: str) -> dict:
         step_num, step_name = step["step"], step["name"]
         step_file = self._phase_dir / f"step{step_num}.md"
@@ -256,7 +267,7 @@ class StepExecutor:
             "exec",
             "--json",
             "--sandbox",
-            "workspace-write",
+            self._codex_sandbox_mode(),
             "--dangerously-bypass-hook-trust",
             "--cd",
             self._root,
@@ -294,11 +305,13 @@ class StepExecutor:
 
     @staticmethod
     def _codex_environment_failure(output: dict) -> Optional[str]:
-        if output.get("exitCode", 0) == 0:
-            return None
         diagnostic = (
             f"{output.get('stderr', '')}\n{output.get('stdout', '')}"
         ).lower()
+        if "orchestrator_helper_launch_failed" in diagnostic:
+            return "Codex Windows sandbox helper를 실행할 수 없습니다."
+        if output.get("exitCode", 0) == 0:
+            return None
         markers = {
             "not logged in": "Codex 인증이 필요합니다.",
             "authentication": "Codex 인증에 실패했습니다.",