Preserve executor path URIs in permission profile workspace roots (#45863)

## Why

Executor profile roots can use path conventions that are not native to the current host. Converting them to host paths during configuration or turn reconstruction can reject or drop those roots, while case-insensitive comparison can hide Windows path spelling changes.

## What changed

- Store profile roots as URI-backed `ProfileWorkspaceRoot` values throughout permission snapshots and thread settings, preserving spelling in equality and deduplication.
- Keep effective workspace roots as `PathUri` values for permission materialization and status summaries. Convert Windows sandbox root hints to native paths only at native Windows sandbox boundaries, rejecting incompatible roots.
- Omit the legacy rollout `workspace_roots` field when profile roots cannot be represented as host paths, retaining the compiled permission profile.

## Testing

Add regression coverage for Windows and UNC root spelling changes, settings restoration and turn recording with foreign roots, executor-root status display, and backend-specific Windows root conversion.

GitOrigin-RevId: 903c068fd74959bdd10e7cb1141aa42b953a59a4

codex-rs/cli/src/debug_sandbox.rs

@@ -254,9 +254,6 @@ async fn run_command_under_sandbox(
     // remaining cwd-dependent policy resolution. `:workspace_roots` entries in
     // the effective profile have already been materialized from config roots.
     let sandbox_policy_cwd = cwd.clone();
-    #[cfg(target_os = "windows")]
-    let workspace_roots = config.effective_workspace_roots();
-
     let env = create_env(
         &config.permissions.shell_environment_policy,
         /*thread_id*/ None,
@@ -323,6 +320,12 @@ async fn run_command_under_sandbox(
         {
             if config.permissions.windows_sandbox_type != codex_sandboxing::SandboxType::WindowsMxc
             {
+                let workspace_roots = config
+                    .effective_workspace_roots()
+                    .iter()
+                    .map(codex_utils_path_uri::PathUri::to_abs_path)
+                    .collect::<std::io::Result<Vec<_>>>()
+                    .context("invalid Windows sandbox workspace roots")?;
                 run_command_under_windows_session(
                     &config,
                     &permission_profile,