Respect turn filesystem permissions during executor skill discovery (#59291)

## Why

Direct executor skill discovery used unrestricted filesystem access, bypassing the turn's permission context. Cached catalogs also needed to account for changes in filesystem access within a turn.

## What changed

- Bind selected capability roots to callback-scoped filesystem access through `AccessedSelectedCapabilityRoot`.
- Pass accessors built with the turn's granted permissions into skill preparation and discovery, removing the executor skill provider's environment lookup and unrestricted accessor.
- Include filesystem access keys in the direct discovery cache so permission changes trigger rediscovery.

## Testing

Extend tests to verify that restricted discovery returns no skills when sandbox access is unavailable, restoring access restores discovery, and changing or restoring access invalidates the catalog cache.

GitOrigin-RevId: 0f7aa7646f65923f65f0cfc0b387d94bd7f2db05

codex-rs/ext/extension-api/src/contributors.rs

@@ -362,11 +362,18 @@ pub trait SkillInvocationContributor: Send + Sync {
     }
 }
 
+/// A selected capability root bound to filesystem access for the current callback.
+#[derive(Clone, Copy)]
+pub struct AccessedSelectedCapabilityRoot<'a> {
+    pub root: &'a SelectedCapabilityRoot,
+    pub fs: &'a dyn codex_file_system::EnvironmentAccess,
+}
+
 /// Runtime inputs shared by preparation, tool construction, and later context consumers.
 #[derive(Clone, Copy)]
 pub struct StepPreparationInput<'a> {
     pub turn_id: &'a str,
-    pub ready_selected_capability_roots: &'a [SelectedCapabilityRoot],
+    pub ready_selected_capability_roots: &'a [AccessedSelectedCapabilityRoot<'a>],
     pub executor_capability_discovery: Option<&'a ExecutorCapabilityDiscoverySnapshot>,
     pub executor_capability_discovery_v2: Option<&'a [ExecutorCapabilityDiscoveryV2Snapshot]>,
     /// Captured plugin policy; an empty snapshot represents no selected plugins.

codex-rs/ext/extension-api/src/lib.rs

@@ -52,6 +52,7 @@ pub use codex_tools::TurnItemEmissionFuture;
 pub use codex_tools::TurnItemEmitter;
 pub use codex_tools::parse_tool_input_schema;
 pub use codex_tools::parse_tool_input_schema_without_compaction;
+pub use contributors::AccessedSelectedCapabilityRoot;
 pub use contributors::ApprovalDecision;
 pub use contributors::ApprovalDecisionInput;
 pub use contributors::ApprovalReviewContributor;