Make selected plugin roots URI-native (#28918)

## Why

Selected capability roots belong to the executor filesystem, not the
app-server host. Converting their path strings into the host's native
`Path` breaks whenever the two machines use different path conventions,
such as a Windows executor behind a Unix app-server.

This PR establishes `PathUri` as the selected-plugin boundary so the
executor remains authoritative for its paths.

## What changed

- Require `selectedCapabilityRoots[].location.path` to be a canonical
`file:` URI and deserialize it directly as `PathUri`; native path
strings are rejected.
- Update the app-server schema, generated TypeScript, examples, and
request coverage for the URI contract.
- Keep selected roots, resolved plugin locations, manifest paths, and
manifest resources as `PathUri`.
- Inspect and read plugin roots and manifests only through the selected
environment's `ExecutorFileSystem`.
- Parse executor manifests with the shared URI-native parser from #29620
instead of projecting them onto the host filesystem.
- Enforce resource containment lexically and preserve the root URI's
POSIX or Windows path convention.
- Cover foreign Windows plugin roots and URI-native manifest resources.

```text
thread/start
  selectedCapabilityRoots[].location.path = "file:///C:/plugins/demo"
                              | PathUri
                              v
                    ExecutorFileSystem
                              |
                              +--> plugin.json
                              +--> manifest resources
```

This PR stops at the shared selected-plugin representation. The next two
PRs remove the remaining host-path projections in the skill and MCP
consumers.

## Stack

1. #29614 — add lexical `PathUri` containment.
2. #29620 — share URI-native manifest path resolution.
3. **This PR** — keep selected plugin roots and resources URI-native.
4. #29626 — load executor skills without host path conversion.
5. #29628 — resolve executor MCP working directories without host path
conversion.

codex-rs/app-server/tests/suite/v2/executor_mcp.rs

@@ -13,6 +13,7 @@ use codex_app_server_protocol::ThreadStartParams;
 use codex_app_server_protocol::ThreadStartResponse;
 use codex_app_server_protocol::TurnStartParams;
 use codex_app_server_protocol::UserInput;
+use codex_utils_path_uri::PathUri;
 use core_test_support::responses;
 use core_test_support::stdio_server_bin;
 use pretty_assertions::assert_eq;
@@ -92,7 +93,7 @@ args = ["exec-server", "--listen", "stdio"]
             id: "executor-demo@1".to_string(),
             location: CapabilityRootLocation::Environment {
                 environment_id: EXECUTOR_ID.to_string(),
-                path: plugin.path().to_string_lossy().into_owned(),
+                path: PathUri::from_host_native_path(plugin.path())?,
             },
         }]),
     )

codex-rs/app-server/tests/suite/v2/executor_skills.rs

@@ -11,6 +11,7 @@ use codex_app_server_protocol::ThreadStartParams;
 use codex_app_server_protocol::ThreadStartResponse;
 use codex_app_server_protocol::TurnStartParams;
 use codex_app_server_protocol::UserInput;
+use codex_utils_path_uri::PathUri;
 use core_test_support::responses;
 use tempfile::TempDir;
 use tokio::time::timeout;
@@ -90,7 +91,7 @@ stream_max_retries = 0
                 id: "demo-plugin@1".to_string(),
                 location: CapabilityRootLocation::Environment {
                     environment_id: "local".to_string(),
-                    path: plugin_dir.path().to_string_lossy().into_owned(),
+                    path: PathUri::from_host_native_path(plugin_dir.path())?,
                 },
             }]),
             ..Default::default()