Honor per-environment permission profiles (#38673)

## What changed

- Add a resolved `permission_profile` to each `EnvironmentConfig` and use the
  complete attachment config for execution and capability-root selection.
- Let `Ready` environment configurations override thread permissions while
  `FromThread` selections continue to inherit them.
- Restrict inherited Guardian environment profiles to read-only permissions.

## Testing

- Add coverage proving that a read-only environment blocks writes even when
  the thread permits workspace writes.
- Update environment inheritance, Guardian review, and capability-root tests
  for the resolved attachment configuration.

GitOrigin-RevId: 1a313b9e4892b1a579a0e880e322a782b4f6c0a7

codex-rs/protocol/src/environment.rs

@@ -1,4 +1,5 @@
 use crate::capabilities::SelectedCapabilityRoot;
+use crate::models::PermissionProfileSnapshot;
 
 /// Configuration supplied for a thread's selected environment.
 #[derive(Clone, Debug, PartialEq, Eq)]
@@ -11,11 +12,13 @@ pub enum EnvironmentConfigState {
     Ready(EnvironmentConfig),
 }
 
-/// Resolved configuration supplied by the owner of a thread/environment attachment.
+/// Resolved configuration for a thread/environment attachment.
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub struct EnvironmentConfig {
     /// Whether shell tools may start login shells in this environment.
     pub allow_login_shell: bool,
+    /// Resolved permissions for this thread's environment attachment.
+    pub permission_profile: PermissionProfileSnapshot,
     /// Capability roots selected for this thread's environment attachment.
     pub selected_capability_roots: Vec<SelectedCapabilityRoot>,
 }