Changelog Update

#8088 feat: if .codex is a sub-folder of a writable root, then make it read-only to the sandbox