Centralize thread environment selection state (#38423)

## What changed

- Make `ThreadEnvironments` the source of truth for live environment selections and use it when building configuration snapshots, permission profiles, per-turn configuration, and MCP refresh inputs.
- Keep settings previews side-effect free while applying accepted environment updates consistently to subsequent turns.
- Move `EnvironmentConfig` into `codex-protocol` so environment ownership no longer depends on a core-only type.

## Testing

- Cover environment previews and snapshots, accepted and rejected steer updates, and active-turn environment stability.

GitOrigin-RevId: 7bcf8fb5df1215f720e4e9c419541a51a871aa5e

codex-rs/protocol/src/environment.rs

@@ -0,0 +1,10 @@
+use crate::capabilities::SelectedCapabilityRoot;
+
+/// Resolved configuration supplied by the owner of a thread/environment attachment.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct EnvironmentConfig {
+    /// Whether shell tools may start login shells in this environment.
+    pub allow_login_shell: bool,
+    /// Capability roots selected for this thread's environment attachment.
+    pub selected_capability_roots: Vec<SelectedCapabilityRoot>,
+}

codex-rs/protocol/src/lib.rs

@@ -16,6 +16,7 @@ pub mod approvals;
 pub mod capabilities;
 pub mod config_types;
 pub mod dynamic_tools;
+mod environment;
 pub mod error;
 pub mod exec_output;
 pub mod items;

codex-rs/protocol/src/protocol.rs

@@ -92,6 +92,7 @@ pub use crate::approvals::NetworkApprovalContext;
 pub use crate::approvals::NetworkApprovalProtocol;
 pub use crate::approvals::NetworkPolicyAmendment;
 pub use crate::approvals::NetworkPolicyRuleAction;
+pub use crate::environment::EnvironmentConfig;
 pub use crate::legacy_events::HasLegacyEvent;
 pub use crate::permissions::FileSystemAccessMode;
 pub use crate::permissions::FileSystemPath;