fix(ce-work-beta): update Codex sandbox flags to current CLI syntax (#770)

Author: davidalee

plugins/compound-engineering/skills/ce-work-beta/references/codex-delegation-workflow.md

@@ -67,8 +67,8 @@ If `consent_granted` is not true (from config `work_delegate_consent`):
 
 Present a one-time consent warning using the platform's blocking question tool (`AskUserQuestion` in Claude Code, `request_user_input` in Codex, `ask_user` in Gemini, `ask_user` in Pi (requires the `pi-ask-user` extension)). The consent warning explains:
 - Delegation sends implementation units to `codex exec` as a structured prompt
-- **yolo mode** (`--yolo`): Full system access including network. Required for verification steps that run tests or install dependencies. **Recommended.**
-- **full-auto mode** (`--full-auto`): Workspace-write sandbox, no network access.
+- **yolo mode** (`--dangerously-bypass-approvals-and-sandbox`): Full system access including network. Required for verification steps that run tests or install dependencies. **Recommended.**
+- **full-auto mode** (`-s workspace-write`): Workspace-write sandbox, no network access by default. Network can be re-enabled by setting `network_access = true` under `[sandbox_workspace_write]` in `~/.codex/config.toml`.
 
 Present the sandbox mode choice: (1) yolo (recommended), (2) full-auto.
 
@@ -224,7 +224,7 @@ SANDBOX_MODE="<sandbox_mode>"
 
 # Resolve sandbox flag
 if [ "$SANDBOX_MODE" = "full-auto" ]; then
-  SANDBOX_FLAG="--full-auto"
+  SANDBOX_FLAG="-s workspace-write"
 else
   SANDBOX_FLAG="--dangerously-bypass-approvals-and-sandbox"
 fi