permissions: derive compatibility policies from profiles (#19392)

## Why

After #19391, `PermissionProfile` and the split filesystem/network
policies could still be stored in parallel. That creates drift risk: a
profile can preserve deny globs, external enforcement, or split
filesystem entries while a cached projection silently loses those
details. This PR makes the profile the runtime source and derives
compatibility views from it.

## What Changed

- Removes stored filesystem/network sandbox projections from
`Permissions` and `SessionConfiguration`; their accessors now derive
from the canonical `PermissionProfile`.
- Derives legacy `SandboxPolicy` snapshots from profiles only where an
older API still needs that field.
- Updates MCP connection and elicitation state to track
`PermissionProfile` instead of `SandboxPolicy` for auto-approval
decisions.
- Adds semantic filesystem-policy comparison so cwd changes can preserve
richer profiles while still recognizing equivalent legacy projections
independent of entry ordering.
- Updates config/session tests to assert profile-derived projections
instead of parallel stored fields.

## Verification

- `cargo test -p codex-core direct_write_roots`
- `cargo test -p codex-core runtime_roots_to_legacy_projection`
- `cargo test -p codex-app-server
requested_permissions_trust_project_uses_permission_profile_intent`



































































---
[//]: # (BEGIN SAPLING FOOTER)
Stack created with [Sapling](https://sapling-scm.com). Best reviewed
with [ReviewStack](https://reviewstack.dev/openai/codex/pull/19392).
* #19395
* #19394
* #19393
* __->__ #19392

codex-rs/cli/src/debug_sandbox.rs

@@ -189,22 +189,23 @@ async fn run_command_under_sandbox(
     let mut child = match sandbox_type {
         #[cfg(target_os = "macos")]
         SandboxType::Seatbelt => {
+            let file_system_sandbox_policy = config.permissions.file_system_sandbox_policy();
+            let network_sandbox_policy = config.permissions.network_sandbox_policy();
             let args = create_seatbelt_command_args(CreateSeatbeltCommandArgsParams {
                 command,
-                file_system_sandbox_policy: &config.permissions.file_system_sandbox_policy,
-                network_sandbox_policy: config.permissions.network_sandbox_policy,
+                file_system_sandbox_policy: &file_system_sandbox_policy,
+                network_sandbox_policy,
                 sandbox_policy_cwd: sandbox_policy_cwd.as_path(),
                 enforce_managed_network: false,
                 network: network.as_ref(),
                 extra_allow_unix_sockets: allow_unix_sockets,
             });
-            let network_policy = config.permissions.network_sandbox_policy;
             spawn_debug_sandbox_child(
                 PathBuf::from("/usr/bin/sandbox-exec"),
                 args,
                 /*arg0*/ None,
                 cwd.to_path_buf(),
-                network_policy,
+                network_sandbox_policy,
                 env,
                 |env_map| {
                     env_map.insert(CODEX_SANDBOX_ENV_VAR.to_string(), "seatbelt".to_string());
@@ -221,23 +222,24 @@ async fn run_command_under_sandbox(
                 .codex_linux_sandbox_exe
                 .expect("codex-linux-sandbox executable not found");
             let use_legacy_landlock = config.features.use_legacy_landlock();
+            let file_system_sandbox_policy = config.permissions.file_system_sandbox_policy();
+            let network_sandbox_policy = config.permissions.network_sandbox_policy();
             let args = create_linux_sandbox_command_args_for_policies(
                 command,
                 cwd.as_path(),
                 config.permissions.sandbox_policy.get(),
-                &config.permissions.file_system_sandbox_policy,
-                config.permissions.network_sandbox_policy,
+                &file_system_sandbox_policy,
+                network_sandbox_policy,
                 sandbox_policy_cwd.as_path(),
                 use_legacy_landlock,
                 /*allow_network_for_proxy*/ false,
             );
-            let network_policy = config.permissions.network_sandbox_policy;
             spawn_debug_sandbox_child(
                 codex_linux_sandbox_exe,
                 args,
                 Some("codex-linux-sandbox"),
                 cwd.to_path_buf(),
-                network_policy,
+                network_sandbox_policy,
                 env,
                 |env_map| {
                     if let Some(network) = network.as_ref() {
@@ -715,17 +717,17 @@ mod tests {
 
         assert!(config_uses_permission_profiles(&config));
         assert!(
-            profile_config.permissions.file_system_sandbox_policy
-                != legacy_config.permissions.file_system_sandbox_policy,
+            profile_config.permissions.file_system_sandbox_policy()
+                != legacy_config.permissions.file_system_sandbox_policy(),
             "test fixture should distinguish profile syntax from legacy sandbox_mode"
         );
         assert_eq!(
-            config.permissions.file_system_sandbox_policy,
-            profile_config.permissions.file_system_sandbox_policy,
+            config.permissions.file_system_sandbox_policy(),
+            profile_config.permissions.file_system_sandbox_policy(),
         );
         assert_ne!(
-            config.permissions.file_system_sandbox_policy,
-            legacy_config.permissions.file_system_sandbox_policy,
+            config.permissions.file_system_sandbox_policy(),
+            legacy_config.permissions.file_system_sandbox_policy(),
         );
 
         Ok(())