Persist active permission profiles in turn context (#39145)

## What changed

- Add the optional `active_permission_profile` field to `TurnContextItem` to record the built-in or named profile that produced the effective permission profile.
- Populate the field when serializing a turn context while preserving compatibility with records where it is absent.

## Testing

- Add coverage verifying that turn-context serialization stores the active permission profile.

GitOrigin-RevId: d69142ab1b26595ab406235f89818ef41370e963

codex-rs/thread-store/src/local/mod.rs

@@ -926,6 +926,7 @@ mod tests {
                 approvals_reviewer: None,
                 sandbox_policy: SandboxPolicy::DangerFullAccess,
                 permission_profile: None,
+                active_permission_profile: None,
                 network: None,
                 file_system_sandbox_policy: None,
                 model: model.to_string(),

codex-rs/thread-store/src/local/model_context_tests.rs

@@ -603,6 +603,7 @@ fn turn_context(root: &Path, turn_id: &str) -> RolloutItem {
         approvals_reviewer: None,
         sandbox_policy: SandboxPolicy::new_read_only_policy(),
         permission_profile: None,
+        active_permission_profile: None,
         network: None,
         file_system_sandbox_policy: None,
         model: "test-model".to_string(),

codex-rs/thread-store/src/local/rollout_migration_tests.rs

@@ -1398,6 +1398,7 @@ async fn migration_compacts_subagent_prefix_and_does_not_project_it() {
                 approvals_reviewer: None,
                 sandbox_policy: SandboxPolicy::new_read_only_policy(),
                 permission_profile: None,
+                active_permission_profile: None,
                 network: None,
                 file_system_sandbox_policy: None,
                 model: "test-model".to_string(),