245.#8275 grant read ACL to exe directory first so we can call the command runnerUnknown|OpenAI/Codex CLICLI
246.#8276 chore: migrate from Config::load_from_base_config_with_overrides to Config...Unknown|OpenAI/Codex CLICLI
250.#8280 add a default dacl to restricted token to enable reading of pipesUnknown|OpenAI/Codex CLICLI