Codex: resolve relative config roots and respect table overrides

Follow-up to 061e7c9e (regression from 95caac51). Relative writable_roots
in config.toml resolve against CODEX_HOME, as Codex does. A whole-table
-c sandbox_workspace_write={...} override is left alone instead of being
replaced by the dotted roots override.