Make turn diff tracking operation backed (#21180)

## Summary
- replace filesystem-based turn diff tracking with an operation-backed
accumulator
- preserve enough verified apply_patch state to render move-overwrite
cases correctly
- keep the turn/diff/updated contract intact while removing remote-only
turn-diff test skips

This takes the assumption that no 3P services rely on the output format
of `apply_patch`

## Why
For the CCA file system isolation push

---------

Co-authored-by: Codex <noreply@openai.com>

codex-rs/arg0/src/lib.rs

@@ -122,7 +122,7 @@ pub fn arg0_dispatch() -> Option<Arg0PathEntryGuard> {
                     codex_exec_server::LOCAL_FS.as_ref(),
                     /*sandbox*/ None,
                 )) {
-                    Ok(()) => 0,
+                    Ok(_) => 0,
                     Err(_) => 1,
                 }
             }