permissions: derive compatibility policies from profiles (#19392)

## Why

After #19391, `PermissionProfile` and the split filesystem/network
policies could still be stored in parallel. That creates drift risk: a
profile can preserve deny globs, external enforcement, or split
filesystem entries while a cached projection silently loses those
details. This PR makes the profile the runtime source and derives
compatibility views from it.

## What Changed

- Removes stored filesystem/network sandbox projections from
`Permissions` and `SessionConfiguration`; their accessors now derive
from the canonical `PermissionProfile`.
- Derives legacy `SandboxPolicy` snapshots from profiles only where an
older API still needs that field.
- Updates MCP connection and elicitation state to track
`PermissionProfile` instead of `SandboxPolicy` for auto-approval
decisions.
- Adds semantic filesystem-policy comparison so cwd changes can preserve
richer profiles while still recognizing equivalent legacy projections
independent of entry ordering.
- Updates config/session tests to assert profile-derived projections
instead of parallel stored fields.

## Verification

- `cargo test -p codex-core direct_write_roots`
- `cargo test -p codex-core runtime_roots_to_legacy_projection`
- `cargo test -p codex-app-server
requested_permissions_trust_project_uses_permission_profile_intent`



































































---
[//]: # (BEGIN SAPLING FOOTER)
Stack created with [Sapling](https://sapling-scm.com). Best reviewed
with [ReviewStack](https://reviewstack.dev/openai/codex/pull/19392).
* #19395
* #19394
* #19393
* __->__ #19392

codex-rs/tui/src/chatwidget.rs

@@ -2379,37 +2379,13 @@ impl ChatWidget {
             tracing::warn!(%err, "failed to sync permissions from SessionConfigured");
             self.config.permissions.sandbox_policy =
                 Constrained::allow_only(event.sandbox_policy.clone());
-            match event.permission_profile.clone() {
-                Some(permission_profile) => {
-                    let (file_system_sandbox_policy, network_sandbox_policy) =
-                        permission_profile.to_runtime_permissions();
-                    self.config.permissions.permission_profile =
-                        Constrained::allow_only(permission_profile);
-                    self.config.permissions.file_system_sandbox_policy = file_system_sandbox_policy;
-                    self.config.permissions.network_sandbox_policy = network_sandbox_policy;
-                }
-                None => {
-                    self.config.permissions.file_system_sandbox_policy =
-                        codex_protocol::permissions::FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(
-                            &event.sandbox_policy,
-                            &event.cwd,
-                        );
-                    self.config.permissions.network_sandbox_policy =
-                        codex_protocol::permissions::NetworkSandboxPolicy::from(
-                            &event.sandbox_policy,
-                        );
-                    let permission_profile =
-                        codex_protocol::models::PermissionProfile::from_runtime_permissions_with_enforcement(
-                            codex_protocol::models::SandboxEnforcement::from_legacy_sandbox_policy(
-                                &event.sandbox_policy,
-                            ),
-                            &self.config.permissions.file_system_sandbox_policy,
-                            self.config.permissions.network_sandbox_policy,
-                        );
-                    self.config.permissions.permission_profile =
-                        Constrained::allow_only(permission_profile);
-                }
-            }
+            let permission_profile = event.permission_profile.clone().unwrap_or_else(|| {
+                codex_protocol::models::PermissionProfile::from_legacy_sandbox_policy(
+                    &event.sandbox_policy,
+                )
+            });
+            self.config.permissions.permission_profile =
+                Constrained::allow_only(permission_profile);
         }
         self.config.approvals_reviewer = event.approvals_reviewer;
         self.status_line_project_root_name_cache = None;

codex-rs/tui/src/chatwidget/tests/history_replay.rs

@@ -380,12 +380,12 @@ async fn session_configured_external_sandbox_keeps_external_runtime_policy() {
     assert_eq!(
         chat.config_ref()
             .permissions
-            .file_system_sandbox_policy
+            .file_system_sandbox_policy()
             .kind,
         FileSystemSandboxKind::ExternalSandbox,
     );
     assert_eq!(
-        chat.config_ref().permissions.network_sandbox_policy,
+        chat.config_ref().permissions.network_sandbox_policy(),
         NetworkSandboxPolicy::Restricted,
     );
 }