Make selected plugin roots URI-native (#28918)

## Why

Selected capability roots belong to the executor filesystem, not the
app-server host. Converting their path strings into the host's native
`Path` breaks whenever the two machines use different path conventions,
such as a Windows executor behind a Unix app-server.

This PR establishes `PathUri` as the selected-plugin boundary so the
executor remains authoritative for its paths.

## What changed

- Require `selectedCapabilityRoots[].location.path` to be a canonical
`file:` URI and deserialize it directly as `PathUri`; native path
strings are rejected.
- Update the app-server schema, generated TypeScript, examples, and
request coverage for the URI contract.
- Keep selected roots, resolved plugin locations, manifest paths, and
manifest resources as `PathUri`.
- Inspect and read plugin roots and manifests only through the selected
environment's `ExecutorFileSystem`.
- Parse executor manifests with the shared URI-native parser from #29620
instead of projecting them onto the host filesystem.
- Enforce resource containment lexically and preserve the root URI's
POSIX or Windows path convention.
- Cover foreign Windows plugin roots and URI-native manifest resources.

```text
thread/start
  selectedCapabilityRoots[].location.path = "file:///C:/plugins/demo"
                              | PathUri
                              v
                    ExecutorFileSystem
                              |
                              +--> plugin.json
                              +--> manifest resources
```

This PR stops at the shared selected-plugin representation. The next two
PRs remove the remaining host-path projections in the skill and MCP
consumers.

## Stack

1. #29614 — add lexical `PathUri` containment.
2. #29620 — share URI-native manifest path resolution.
3. **This PR** — keep selected plugin roots and resources URI-native.
4. #29626 — load executor skills without host path conversion.
5. #29628 — resolve executor MCP working directories without host path
conversion.

codex-rs/plugin/src/provider.rs

@@ -1,6 +1,6 @@
 use crate::manifest::PluginManifest;
 use codex_protocol::capabilities::SelectedCapabilityRoot;
-use codex_utils_absolute_path::AbsolutePathBuf;
+use codex_utils_path_uri::PathUri;
 use std::error::Error as StdError;
 use std::future::Future;
 use thiserror::Error;
@@ -11,8 +11,8 @@ pub enum PluginResourceLocator {
     Environment {
         /// Environment whose filesystem owns the resource.
         environment_id: String,
-        /// Absolute resource path within that filesystem.
-        path: AbsolutePathBuf,
+        /// Resource URI within that filesystem.
+        path: PathUri,
     },
 }
 
@@ -22,8 +22,8 @@ pub enum ResolvedPluginLocation {
     Environment {
         /// Environment whose filesystem owns the package.
         environment_id: String,
-        /// Absolute package root within that filesystem.
-        root: AbsolutePathBuf,
+        /// Package root URI within that filesystem.
+        root: PathUri,
     },
 }
 
@@ -40,10 +40,7 @@ pub struct ResolvedPlugin {
 #[derive(Clone, Debug, Error, PartialEq, Eq)]
 pub enum ResolvedPluginError {
     #[error("plugin resource path `{path}` is outside package root `{root}`")]
-    ResourceOutsideRoot {
-        root: AbsolutePathBuf,
-        path: AbsolutePathBuf,
-    },
+    ResourceOutsideRoot { root: PathUri, path: PathUri },
 }
 
 impl ResolvedPlugin {
@@ -51,9 +48,9 @@ impl ResolvedPlugin {
     pub fn from_environment(
         selected_root_id: String,
         environment_id: String,
-        root: AbsolutePathBuf,
-        manifest_path: AbsolutePathBuf,
-        manifest: PluginManifest<AbsolutePathBuf>,
+        root: PathUri,
+        manifest_path: PathUri,
+        manifest: PluginManifest<PathUri>,
     ) -> Result<Self, ResolvedPluginError> {
         let manifest_path = environment_resource(&environment_id, &root, manifest_path)?;
         let manifest = manifest
@@ -92,10 +89,10 @@ impl ResolvedPlugin {
 
 fn environment_resource(
     environment_id: &str,
-    root: &AbsolutePathBuf,
-    path: AbsolutePathBuf,
+    root: &PathUri,
+    path: PathUri,
 ) -> Result<PluginResourceLocator, ResolvedPluginError> {
-    if !path.as_path().starts_with(root.as_path()) {
+    if !path.starts_with(root) {
         return Err(ResolvedPluginError::ResourceOutsideRoot {
             root: root.clone(),
             path,