permissions: finish profile-backed app surfaces

[bolinfest]

Why

Now that core execution is profile-backed, the user-facing and app-facing surfaces should stop presenting the legacy sandbox projection as authoritative. This matters for fidelity: External and Disabled can both look permissive through old sandbox-mode summaries, but they mean different operational states.

What Changed

• Sends PermissionProfile from the in-process exec client for thread start, resume, and turn start instead of falling back to legacy sandbox mode.
• Summarizes CLI and TUI sandbox state from profiles, including distinct labels for external-sandbox and danger-full-access plus writable-root summaries for managed profiles.
• Updates app-server project-trust checks to ask whether the active/requested profile can write the project cwd, rather than matching legacy sandbox variants.
• Computes bwrap warnings from whether the profile actually requires a platform sandbox.
• Classifies analytics sandbox mode directly from profile filesystem/network state while preserving the legacy external_sandbox bucket for managed full-filesystem profiles with restricted network.
• Adds coverage for managed, disabled, and external profile summaries, plus analytics classification for managed full-disk/restricted-network profiles.

Verification

• cargo check -p codex-config -p codex-core -p codex-sandboxing -p codex-app-server -p codex-cli -p codex-tui
• cargo test -p codex-analytics managed_full_disk_with_restricted_network_reports_external_sandbox
• cargo test -p codex-core direct_write_roots
• cargo test -p codex-core runtime_roots_to_legacy_projection
• cargo test -p codex-app-server requested_permissions_trust_project_uses_permission_profile_intent

---

Stack created with Sapling. Best reviewed with ReviewStack.

• permissions: derive legacy exec policies at boundaries #19737
• permissions: constrain requirements as profiles #19736
• permissions: store only constrained permission profiles #19735
• permissions: centralize legacy sandbox projection #19734
• -> permissions: finish profile-backed app surfaces #19395

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6c1797f185

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".