Use ApiPathString in app-server filesystem permission paths (#28367)

## Why

Clients running an app-server on one OS and an exec-server on another OS
need to be able to pass sandbox config to app-server that refers to
resources on the executor's foreign OS.

## What

`AbsolutePathBuf` can't represent these paths and we don't want users to
be exposed to `PathUri` yet, so this moves the public app-server API to
be expressed in terms of `ApiPathString`.

Stacked on #28165.

- change app-server v2 filesystem permission paths, including legacy
read/write roots, to `ApiPathString`
- localize API paths through `PathUri` when converting into the current
native core permission types
- make path-bearing permission conversions fallible and surface
localization failures instead of silently treating malformed grants as
ordinary denials
- propagate conversion failures through app-server and TUI approval
handling
- regenerate the app-server JSON and TypeScript schemas
- leave migration TODOs on native-path conversions so they can be
removed once core permission paths use `PathUri`

codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json

@@ -6020,7 +6020,7 @@
           "read": {
             "description": "This will be removed in favor of `entries`.",
             "items": {
-              "$ref": "#/definitions/v2/AbsolutePathBuf"
+              "$ref": "#/definitions/v2/ApiPathString"
             },
             "type": [
               "array",
@@ -6030,7 +6030,7 @@
           "write": {
             "description": "This will be removed in favor of `entries`.",
             "items": {
-              "$ref": "#/definitions/v2/AbsolutePathBuf"
+              "$ref": "#/definitions/v2/ApiPathString"
             },
             "type": [
               "array",
@@ -6135,6 +6135,9 @@
         },
         "type": "object"
       },
+      "ApiPathString": {
+        "type": "string"
+      },
       "AppBranding": {
         "description": "EXPERIMENTAL - app metadata returned by app-list APIs.",
         "properties": {
@@ -9372,7 +9375,7 @@
           {
             "properties": {
               "path": {
-                "$ref": "#/definitions/v2/AbsolutePathBuf"
+                "$ref": "#/definitions/v2/ApiPathString"
               },
               "type": {
                 "enum": [