Preserve filesystem authority when loading skills (#59279)

## Why

Skill discovery and metadata loading used raw filesystem handles with unrestricted reads, and cache keys distinguished filesystems without accounting for captured permissions.

## What changed

- Pass borrowed `EnvironmentAccess` accessors through skill root resolution, discovery, canonicalization, and metadata reads.
- Include captured permissions in skill snapshot and empty remote root cache keys.
- Add fixed-path watches to `EnvironmentAccess`, falling back to live discovery when read restrictions prevent using unsandboxed executor watches.
- Keep user and plugin roots under host filesystem authority independently of the selected repository executor.

## Testing

Extend remote root cache coverage to verify that changing captured permissions triggers a fresh scan and that restricted accessors decline unsandboxed watches.

GitOrigin-RevId: 97d4bfdfcba78a93fc8845773c6397d4364494e3

codex-rs/core/src/agent/role_tests.rs

@@ -684,7 +684,11 @@ enabled = false
     let snapshot = skills_service
         .snapshot_for_config(
             &skills_input,
-            Some(Arc::clone(&codex_exec_server::LOCAL_FS)),
+            Some(
+                &codex_exec_server::FileSystemEnvironmentAccessor::unrestricted(
+                    &codex_exec_server::LOCAL_FS,
+                ),
+            ),
         )
         .await;
     let outcome = snapshot.outcome();