codex exec --sandbox read-only   --output-last-message reports/explanation.txt   "Explain report.py and identify any path or symlink risks. Do not edit files."