Remove generated-default filesystem path variants (#33632)

## What changed

- Represent built-in filesystem policy entries with the same `Path` and
  `Special` variants used by other entries.
- Remove generated-default filtering from Windows sandbox policy resolution and
  simplify elevated deny-write handling to rely on direct-runtime enforcement
  and the legacy policy projection.
- Update protocol conversions, policy transforms, and profile expectations for
  the reduced filesystem path model.

GitOrigin-RevId: a65793e6855a03d52a575e82cb3d4b9b2e32db5c

codex-rs/core/src/exec_tests.rs

@@ -803,51 +803,6 @@ fn windows_elevated_supports_split_write_read_carveouts() {
     );
 }
 
-#[cfg(target_os = "windows")]
-#[test]
-fn windows_workspace_defaults_do_not_hide_explicit_metadata_carveouts() {
-    let temp_dir = tempfile::TempDir::new().expect("tempdir");
-    let cwd = temp_dir.path().canonicalize().expect("canonical cwd").abs();
-
-    let default_profile = PermissionProfile::workspace_write();
-    let default_overrides = resolve_windows_elevated_filesystem_overrides(
-        SandboxType::WindowsRestrictedToken,
-        &default_profile,
-        &cwd,
-        /*use_windows_elevated_backend*/ true,
-    )
-    .expect("resolve workspace defaults");
-    assert!(
-        default_overrides.is_none_or(|overrides| overrides.additional_deny_write_paths.is_empty())
-    );
-
-    for name in codex_protocol::permissions::PROTECTED_METADATA_PATH_NAMES {
-        let (mut explicit_policy, network_policy) = default_profile.to_runtime_permissions();
-        explicit_policy
-            .entries
-            .push(codex_protocol::permissions::FileSystemSandboxEntry {
-                path: codex_protocol::permissions::FileSystemPath::Special {
-                    value: codex_protocol::permissions::FileSystemSpecialPath::project_roots(Some(
-                        (*name).into(),
-                    )),
-                },
-                access: codex_protocol::permissions::FileSystemAccessMode::Read,
-            });
-        let explicit_profile =
-            PermissionProfile::from_runtime_permissions(&explicit_policy, network_policy);
-
-        let overrides = resolve_windows_elevated_filesystem_overrides(
-            SandboxType::WindowsRestrictedToken,
-            &explicit_profile,
-            &cwd,
-            /*use_windows_elevated_backend*/ true,
-        )
-        .expect("resolve explicit metadata carveout")
-        .expect("explicit metadata carveout needs an override");
-        assert_eq!(overrides.additional_deny_write_paths, vec![cwd.join(name)]);
-    }
-}
-
 #[test]
 fn windows_elevated_supports_unreadable_split_carveouts() {
     let temp_dir = tempfile::TempDir::new().expect("tempdir");