fix: accept two macOS automation input shapes for approval payload compatibility

[celia-oai]

Summary

This PR:

1. fixes a deserialization mismatch for macOS automation permissions in approval payloads by making core parsing accept both supported wire shapes for bundle IDs.
2. added #[serde(default)] to MacOsSeatbeltProfileExtensions so omitted fields deserialize to secure defaults.

Why this change is needed

MacOsAutomationPermission uses #[serde(try_from = "MacOsAutomationPermissionDe")], so deserialization is controlled by MacOsAutomationPermissionDe. After we aligned v2 additionalPermissions.macos.automations to the core shape, approval payloads started including { "bundle_ids": [...] } in some paths. MacOsAutomationPermissionDe previously accepted only "none" | "all" or a plain array, so object-shaped bundle IDs failed with data did not match any variant of untagged enum MacOsAutomationPermissionDe. This change restores compatibility by accepting both forms while preserving existing normalization behavior (trim values and map empty bundle lists to None).

Validation

saw this error went away when running

cargo run -p codex-app-server-test-client -- \
    --codex-bin ./target/debug/codex \
    -c 'approval_policy="on-request"' \
    -c 'features.shell_zsh_fork=true' \
    -c 'zsh_path="/tmp/codex-zsh-fork/package/vendor/aarch64-apple-darwin/zsh/macos-15/zsh"' \
    send-message-v2 --experimental-api \
    'Use $apple-notes and run scripts/notes_info now.'

:

Error: failed to deserialize ServerRequest from JSONRPCRequest

Caused by:
    data did not match any variant of untagged enum MacOsAutomationPermissionDe