Apply permission profile updates to future turn environments (#37031)

## What changed

- Include the current permission profile in each turn environment's configuration.
- Refresh retained environment configurations when session settings change, while preserving the configuration already captured by active turns.
- Keep environment connection and shell snapshot resolution reusable across configuration updates.

## Testing

- Cover permission profile updates applied through both session settings updates and per-turn updates.
- Verify that pending environment resolutions use the configuration captured by their turn and that configuration-only updates do not retry failed environments.

GitOrigin-RevId: 923694f0729b87a118d7635ade3a8ca9bcd4e7b1

codex-rs/core/src/config/resolved_permission_profile.rs

@@ -271,6 +271,12 @@ impl PermissionProfileState {
         self.resolved_permission_profile.get().permission_profile()
     }
 
+    pub(crate) fn snapshot(&self) -> PermissionProfileSnapshot {
+        PermissionProfileSnapshot {
+            resolved_permission_profile: self.resolved_permission_profile.get().clone(),
+        }
+    }
+
     pub(crate) fn active_permission_profile(&self) -> Option<ActivePermissionProfile> {
         self.resolved_permission_profile
             .get()