Route apply_patch through the environment filesystem (#17674)

## Summary
- route apply_patch runtime execution through the selected Environment
filesystem instead of the local self-exec path
- keep the standalone apply_patch command surface intact while restoring
its launcher/test/docs contract
- add focused apply_patch filesystem sandbox regression coverage

## Validation
- remote devbox Bazel run in progress
- passed: //codex-rs/apply-patch:apply-patch-unit-tests
--test_filter=test_read_file_utf8_with_context_reports_invalid_utf8
- in progress / follow-up: focused core and exec Bazel test slices on
dev

## Follow-up under review
- remote pre-verification and approval/retry behavior still need
explicit scrutiny for delete/update flows
- runtime sandbox-denial classification may need a tighter assertion
path than rendered stderr matching

---------

Co-authored-by: Codex <noreply@openai.com>

codex-rs/core/src/apply_patch.rs

@@ -18,16 +18,13 @@ pub(crate) enum InternalApplyPatchInvocation {
 
     /// The `apply_patch` call was approved, either automatically because it
     /// appears that it should be allowed based on the user's sandbox policy
-    /// *or* because the user explicitly approved it. In either case, we use
-    /// exec with [`codex_apply_patch::CODEX_CORE_APPLY_PATCH_ARG1`] to realize
-    /// the `apply_patch` call,
-    /// but [`ApplyPatchExec::auto_approved`] is used to determine the sandbox
-    /// used with the `exec()`.
-    DelegateToExec(ApplyPatchExec),
+    /// *or* because the user explicitly approved it. The runtime realizes the
+    /// patch through the selected environment filesystem.
+    DelegateToRuntime(ApplyPatchRuntimeInvocation),
 }
 
 #[derive(Debug)]
-pub(crate) struct ApplyPatchExec {
+pub(crate) struct ApplyPatchRuntimeInvocation {
     pub(crate) action: ApplyPatchAction,
     pub(crate) auto_approved: bool,
     pub(crate) exec_approval_requirement: ExecApprovalRequirement,
@@ -49,7 +46,7 @@ pub(crate) async fn apply_patch(
         SafetyCheck::AutoApprove {
             user_explicitly_approved,
             ..
-        } => InternalApplyPatchInvocation::DelegateToExec(ApplyPatchExec {
+        } => InternalApplyPatchInvocation::DelegateToRuntime(ApplyPatchRuntimeInvocation {
             action,
             auto_approved: !user_explicitly_approved,
             exec_approval_requirement: ExecApprovalRequirement::Skip {
@@ -61,7 +58,7 @@ pub(crate) async fn apply_patch(
             // Delegate the approval prompt (including cached approvals) to the
             // tool runtime, consistent with how shell/unified_exec approvals
             // are orchestrator-driven.
-            InternalApplyPatchInvocation::DelegateToExec(ApplyPatchExec {
+            InternalApplyPatchInvocation::DelegateToRuntime(ApplyPatchRuntimeInvocation {
                 action,
                 auto_approved: false,
                 exec_approval_requirement: ExecApprovalRequirement::NeedsApproval {