## Why
Selected environments can have different filesystem and network permissions, but context previously described only the primary environment's rules.
## What changed
- Add the disabled-by-default `per_environment_context` feature.
- Group filesystem and network access under each environment ID, including when only one environment is selected. Label shared network requirements separately.
- Scope permission instructions and incremental updates to each environment. Withdraw stale descriptions and use labeled thread defaults when no environment is ready.
- Track approved command prefixes separately so new approvals do not require repeating unchanged permission instructions.
## Testing
Extend rendering and permission snapshots for scoped context, removed scopes, thread defaults, and format transitions. Update the active-turn scenario to cover two environments with different permissions, changing only the second environment's workspace and permissions and restoring its defaults on the next turn.
GitOrigin-RevId: c948089c12da7b15eee378d8c5a23a233d24502b
sayan-oai
b1573f1024