Preserve target-native paths in command approvals (#42577)

## What changed

- Pass the selected executor's `PathUri` through user command approval requests instead of converting the working directory to a host-native path.
- Make native-path permission helpers explicitly local and require executor-aware permission transforms to receive a `FileSystemSandboxPolicyContext`.
- Cover approved remote commands to verify that the approval request reports the selected remote working directory and execution resumes after approval.

GitOrigin-RevId: 0aa3042f2d7594af6c7d0abf31d7f99cf67d5556

codex-rs/app-server/src/request_processors/thread_processor.rs

@@ -1329,7 +1329,7 @@ impl ThreadRequestProcessor {
             codex_protocol::models::PermissionProfile::Managed { .. } => {
                 effective_permission_profile
                     .file_system_sandbox_policy()
-                    .can_write_path_with_cwd(config.cwd.as_path(), config.cwd.as_path())
+                    .can_write_local_path_with_cwd(config.cwd.as_path(), config.cwd.as_path())
             }
         };