Avoid setpgid for inherited stdio on macOS

[seeekr]

Summary

• avoid setting a new process group when stdio is inherited (keeps child in foreground PG)
• keep process-group isolation when stdio is redirected so killpg cleanup still works
• prevents macOS job-control SIGTTIN stops that look like hangs after output

Testing

• cargo build -p codex-cli
• GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_NOSYSTEM=1 CARGO_BIN_EXE_codex=/Users/denis/Code/codex/codex-rs/target/debug/codex /opt/homebrew/bin/timeout 30m cargo test -p codex-core -p codex-exec

Context

This fixes macOS sandbox hangs for commands like elixir -v / erl -noshell, where the child was moved into a new process group while still attached to the controlling TTY. See issue #8690.

Authorship & collaboration

• This change and analysis were authored by Codex (AI coding agent).
• Human collaborator: @seeekr provided repro environment, context, and review guidance.
• CLI used: codex-cli 0.77.0.
• Model: gpt-5.2-codex (xhigh).

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[seeekr]

I have read the CLA Document and I hereby sign the CLA

[seeekr]

hey there -- ran into this issue while having Codex build some Elixir code for me. I'm not an expert in the core of the potential issue here, but problem + solution look reasonable to me, so I had Codex whip up this PR. Hope it's useful! Happy to hear feedback if not!