Remove generated-default filesystem path variants (#33632)

## What changed

- Represent built-in filesystem policy entries with the same `Path` and
  `Special` variants used by other entries.
- Remove generated-default filtering from Windows sandbox policy resolution and
  simplify elevated deny-write handling to rely on direct-runtime enforcement
  and the legacy policy projection.
- Update protocol conversions, policy transforms, and profile expectations for
  the reduced filesystem path model.

GitOrigin-RevId: a65793e6855a03d52a575e82cb3d4b9b2e32db5c

codex-rs/protocol/src/models.rs

@@ -111,10 +111,7 @@ impl FileSystemPermissions {
     ) -> impl Iterator<Item = (&AbsolutePathBuf, FileSystemAccessMode)> {
         self.entries.iter().filter_map(|entry| match &entry.path {
             FileSystemPath::Path { path } => Some((path, entry.access)),
-            FileSystemPath::GeneratedDefaultPath { .. }
-            | FileSystemPath::GlobPattern { .. }
-            | FileSystemPath::Special { .. }
-            | FileSystemPath::GeneratedDefaultSpecial { .. } => None,
+            FileSystemPath::GlobPattern { .. } | FileSystemPath::Special { .. } => None,
         })
     }