windows-sandbox: remove SandboxPolicy runner plumbing (#23813)

## Why

The Windows sandbox runner still carried the old `SandboxPolicy`
compatibility path even though core now computes `PermissionProfile`.
That meant Windows command-runner execution could only see the legacy
projection, so profile-only filesystem rules such as deny globs were not
part of the runner input.

## What Changed

- Removed the Windows-local `SandboxPolicy` parser/export and deleted
`windows-sandbox-rs/src/policy.rs`.
- Changed restricted-token capture/session setup, elevated setup,
world-writable audit, read-root grant, and command-runner session APIs
to accept `PermissionProfile` plus the profile cwd.
- Bumped the elevated command-runner IPC protocol to version 2 because
`SpawnRequest` now carries `permission_profile` /
`permission_profile_cwd` instead of the legacy `policy_json_or_preset` /
`sandbox_policy_cwd` fields.
- Updated core exec, unified exec, debug-sandbox, TUI setup/grant flows,
and app-server setup to pass the actual effective `PermissionProfile`.
- Left regression coverage asserting the old IPC policy fields are
absent and the runner serializes tagged `PermissionProfile` JSON.

## Verification

- `cargo test -p codex-windows-sandbox`
- `cargo test -p codex-core windows_sandbox`
- `cargo test -p codex-app-server
request_processors::windows_sandbox_processor`
- `just fix -p codex-windows-sandbox -p codex-core -p codex-app-server
-p codex-cli -p codex-tui`
- `just fix -p codex-cli -p codex-tui`
- `just fix -p codex-windows-sandbox -p codex-tui`
- `rg "\\bSandboxPolicy\\b" codex-rs/windows-sandbox-rs` returned no
matches.

Note: `cargo test -p codex-cli` was attempted but did not reach crate
tests because local disk filled while compiling dependencies (`No space
left on device`). The targeted clippy pass compiled the affected CLI/TUI
surfaces afterward.




---
[//]: # (BEGIN SAPLING FOOTER)
Stack created with [Sapling](https://sapling-scm.com). Best reviewed
with [ReviewStack](https://reviewstack.dev/openai/codex/pull/23813).
* #24108
* __->__ #23813

codex-rs/cli/src/debug_sandbox.rs

@@ -209,9 +209,9 @@ async fn run_command_under_sandbox(
     // does not support `--cwd`, but let's use the config value for consistency.
     let cwd = config.cwd.clone();
     // For now, we always use the same cwd for both the command and the
-    // sandbox policy. In the future, we could add a CLI option to set them
+    // permission profile. In the future, we could add a CLI option to set them
     // separately.
-    let sandbox_policy_cwd = cwd.clone();
+    let permission_profile_cwd = cwd.clone();
 
     let env = create_env(
         &config.permissions.shell_environment_policy,
@@ -222,7 +222,8 @@ async fn run_command_under_sandbox(
     if let SandboxType::Windows = sandbox_type {
         #[cfg(target_os = "windows")]
         {
-            run_command_under_windows_session(&config, command, cwd, sandbox_policy_cwd, env).await;
+            run_command_under_windows_session(&config, command, cwd, permission_profile_cwd, env)
+                .await;
         }
         #[cfg(not(target_os = "windows"))]
         {
@@ -265,7 +266,7 @@ async fn run_command_under_sandbox(
                 command,
                 file_system_sandbox_policy: &file_system_sandbox_policy,
                 network_sandbox_policy,
-                sandbox_policy_cwd: sandbox_policy_cwd.as_path(),
+                sandbox_policy_cwd: permission_profile_cwd.as_path(),
                 enforce_managed_network: false,
                 network: network.as_ref(),
                 extra_allow_unix_sockets: allow_unix_sockets,
@@ -297,7 +298,7 @@ async fn run_command_under_sandbox(
                 command,
                 cwd.as_path(),
                 &config.permissions.effective_permission_profile(),
-                sandbox_policy_cwd.as_path(),
+                permission_profile_cwd.as_path(),
                 use_legacy_landlock,
                 allow_network_for_proxy(managed_network_requirements_enabled),
             );
@@ -349,24 +350,15 @@ async fn run_command_under_windows_session(
     config: &Config,
     command: Vec<String>,
     cwd: AbsolutePathBuf,
-    sandbox_policy_cwd: AbsolutePathBuf,
+    permission_profile_cwd: AbsolutePathBuf,
     env: std::collections::HashMap<String, String>,
 ) -> ! {
     use codex_core::windows_sandbox::WindowsSandboxLevelExt;
     use codex_protocol::config_types::WindowsSandboxLevel;
-    use codex_windows_sandbox::spawn_windows_sandbox_session_elevated;
+    use codex_windows_sandbox::spawn_windows_sandbox_session_elevated_for_permission_profile;
     use codex_windows_sandbox::spawn_windows_sandbox_session_legacy;
 
-    let sandbox_policy = config
-        .permissions
-        .legacy_sandbox_policy(sandbox_policy_cwd.as_path());
-    let policy_str = match serde_json::to_string(&sandbox_policy) {
-        Ok(policy_str) => policy_str,
-        Err(err) => {
-            eprintln!("windows sandbox failed to serialize policy: {err}");
-            std::process::exit(1);
-        }
-    };
+    let permission_profile = config.permissions.effective_permission_profile();
 
     let use_elevated = matches!(
         WindowsSandboxLevel::from_config(config),
@@ -374,9 +366,9 @@ async fn run_command_under_windows_session(
     );
 
     let spawned = if use_elevated {
-        spawn_windows_sandbox_session_elevated(
-            policy_str.as_str(),
-            sandbox_policy_cwd.as_path(),
+        spawn_windows_sandbox_session_elevated_for_permission_profile(
+            &permission_profile,
+            permission_profile_cwd.as_path(),
             config.codex_home.as_path(),
             command,
             cwd.as_path(),
@@ -394,8 +386,8 @@ async fn run_command_under_windows_session(
         .await
     } else {
         spawn_windows_sandbox_session_legacy(
-            policy_str.as_str(),
-            sandbox_policy_cwd.as_path(),
+            &permission_profile,
+            permission_profile_cwd.as_path(),
             config.codex_home.as_path(),
             command,
             cwd.as_path(),