Restore permission profiles when resuming threads (#39153)

## Why

Cold resumes and forks could lose the thread's active permission profile and
fall back to the current configured default.

## What changed

- Restore the latest persisted approval policy, approvals reviewer, and active
  permission-profile ID when resuming or forking a thread.
- Re-resolve persisted profile IDs through current configuration and
  requirements. Missing or invalid profiles fall back to the configured
  default, while threads without a persisted profile continue to use current
  configuration.
- Keep explicit permission and approval overrides ahead of persisted settings.

## Testing

Added coverage for legacy and paginated histories, settings updates, explicit
overrides, removed or changed profiles, requirement fallbacks, and forks.

GitOrigin-RevId: 2289af2f3206bf131a6ffe0e8447e8d402e76c47

codex-rs/exec/src/lib.rs

@@ -413,6 +413,7 @@ pub async fn run_main(cli: Cli, arg0_paths: Arg0DispatchPaths) -> anyhow::Result
         sandbox_mode,
         permission_profile: None,
         default_permissions: None,
+        persisted_permission_profile_id: None,
         cwd: resolved_cwd,
         workspace_roots: None,
         model_provider: model_provider.clone(),