path-uri: remove legacy path deserialization (#29158)

## Why

I'd originally added `PathUri` legacy path deserialization thinking we'd
want it for having `PathUri` in public app-server APIs. Since then we've
added `LegacyAppPathString` to handle the messy conversions that we need
for backcompat. It's confusing for `PathUri` to support deserializing
legacy paths when we don't yet want to actually expose app-server
callers or rollout storage to the new URI format.

Stacked on top of #29472 to avoid breaking compatibility in case those
types ended up stored somewhere for someone.

## What changed

- Parse deserialized `PathUri` values exclusively as valid `file:` URIs.
- Replace legacy acceptance coverage with rejection coverage for
top-level filesystem paths and sandbox working directories.
- Serialize CWDs in hand-built exec-server process requests as `PathUri`
values.

codex-rs/exec-server/src/protocol.rs

@@ -591,38 +591,33 @@ mod tests {
     }
 
     #[test]
-    fn filesystem_protocol_accepts_legacy_absolute_paths_and_serializes_path_uris() {
-        let legacy_path = std::env::current_dir()
+    fn filesystem_protocol_rejects_native_absolute_paths() {
+        let native_path = std::env::current_dir()
             .expect("current directory")
-            .join("legacy-file.txt");
-        let legacy_cwd = std::env::current_dir().expect("current directory");
-        let native_sandbox = FileSystemSandboxContext::from_permission_profile_with_cwd(
-            PermissionProfile::default(),
-            PathUri::from_host_native_path(&legacy_cwd).expect("cwd URI"),
-        );
-        let mut legacy_sandbox =
-            serde_json::to_value(&native_sandbox).expect("sandbox should serialize");
-        legacy_sandbox["cwd"] = serde_json::json!(legacy_cwd.to_string_lossy());
-        let params: FsReadFileParams = serde_json::from_value(serde_json::json!({
-            "path": legacy_path.to_string_lossy(),
-            "sandbox": legacy_sandbox,
-        }))
-        .expect("legacy absolute path should deserialize");
-        let expected_sandbox = native_sandbox;
-        let expected = FsReadFileParams {
-            path: PathUri::from_host_native_path(legacy_path).expect("path URI"),
-            sandbox: Some(expected_sandbox.clone()),
-        };
+            .join("native-file.txt");
+        let native_cwd = std::env::current_dir().expect("current directory");
 
-        assert_eq!(params, expected);
-        assert_eq!(
-            serde_json::to_value(params).expect("params should serialize"),
-            serde_json::json!({
-                "path": expected.path.to_string(),
-                "sandbox": serde_json::to_value(expected_sandbox)
-                    .expect("sandbox should serialize"),
-            })
+        serde_json::from_value::<FsReadFileParams>(serde_json::json!({
+            "path": native_path.to_string_lossy(),
+            "sandbox": null,
+        }))
+        .expect_err("native absolute path should not deserialize as a URI");
+
+        let sandbox = FileSystemSandboxContext::from_permission_profile_with_cwd(
+            PermissionProfile::default(),
+            PathUri::from_host_native_path(&native_cwd).expect("cwd URI"),
         );
+        let mut native_path_sandbox =
+            serde_json::to_value(sandbox).expect("sandbox should serialize");
+        native_path_sandbox["cwd"] = serde_json::json!(native_cwd.to_string_lossy());
+
+        serde_json::from_value::<FsReadFileParams>(serde_json::json!({
+            "path": PathUri::from_host_native_path(native_path)
+                .expect("path URI")
+                .to_string(),
+            "sandbox": native_path_sandbox,
+        }))
+        .expect_err("native absolute sandbox cwd should not deserialize as a URI");
     }
 
     #[test]