Constrain Guardian reviews to parent filesystem permissions (#38377)

## Why

Guardian review sessions must not gain access to paths that the parent turn is
not allowed to read.

## What changed

- Derive Guardian permissions by intersecting managed parent filesystem rules
  with read-only access, preserving denied paths and restricting network access.
- Offer Guardian execution tools only when a managed sandbox can enforce those
  rules.
- Include the selected environment IDs in the review-session reuse key so a
  session is not reused across different environment sets.

## Testing

Update the Guardian reuse integration test to verify that a review cannot read
a parent-denied file or write a local file while consecutive reviews still
reuse the same session.

GitOrigin-RevId: 20f17a6c379f1eda651e8508459d642a51e4ce94

codex-rs/protocol/src/models.rs

@@ -387,6 +387,33 @@ impl PermissionProfile {
         }
     }
 
+    /// Intersects managed filesystem permissions with read-only access and restricts network.
+    ///
+    /// Returns `None` when filesystem enforcement belongs to an external caller.
+    pub fn intersect_with_read_only(&self) -> Option<Self> {
+        let mut file_system = self.file_system_sandbox_policy();
+        match file_system.kind {
+            FileSystemSandboxKind::Restricted => {
+                for entry in &mut file_system.entries {
+                    entry.access = match entry.access {
+                        FileSystemAccessMode::Read | FileSystemAccessMode::Write => {
+                            FileSystemAccessMode::Read
+                        }
+                        FileSystemAccessMode::Deny => FileSystemAccessMode::Deny,
+                    };
+                }
+            }
+            FileSystemSandboxKind::Unrestricted => {
+                file_system = FileSystemSandboxPolicy::read_only();
+            }
+            FileSystemSandboxKind::ExternalSandbox => return None,
+        }
+        Some(Self::from_runtime_permissions(
+            &file_system,
+            NetworkSandboxPolicy::Restricted,
+        ))
+    }
+
     /// Managed workspace-write filesystem access with restricted network
     /// access.
     ///