## What changed
- Bootstrap the cloud configuration bundle when `codex sandbox` receives an
explicit permission profile together with `--include-managed-config`.
- Pass the resulting managed requirements through sandbox configuration loading
so the requested cloud-managed permission profile is enforced.
- Keep the default path from loading cloud-managed profiles when managed
configuration is not requested.
## Testing
- Add unit and subprocess coverage for fetching, caching, and enforcing a
cloud-managed permission profile.
GitOrigin-RevId: dfe637af5895496ae88b8128ca2f5ec29341ad06
