Allow NFS database migration with shared file permissions (#57226)

## Why

NFS database migration rejected files with group or other access. Allow accessible databases to migrate while making the effects on file access explicit.

## What changed

- Preserve file mode bits during migration while requiring owner read and write permissions on replacement files.
- Before CLI consent, disclose that replacements belong to the current user and do not copy the original owner, group, or extended ACLs. Require explicit confirmation for files with permissions other than `0600`.
- Warn at Linux TUI startup when NFS databases need migration and permission confirmation. Inspect journal mode without accessing WAL shared memory or releasing another connection's locks.
- Allow five seconds to acquire the exclusive database lock during migration.

## Testing

Add CLI coverage for consent, access disclosures, and migration of `0644` files. Extend state tests for permission preservation, rejection of missing owner access, and interrupted migration recovery; snapshot the startup warning.

GitOrigin-RevId: 2d9c3663172c3e631a787dc1dc76db95c39e6aa1

codex-rs/state/src/sqlite.rs

@@ -219,6 +219,7 @@ impl SqliteConfig {
     }
 
     /// When enforcement is enabled, migrate existing WAL databases on NFS before opening them.
+    /// Other clients on all hosts must remain stopped during migration.
     pub fn enable_delete_mode_on_nfs(mut self, enabled: bool) -> Self {
         self.enforce_delete_on_nfs = enabled;
         self