test: construct permission profiles directly

[bolinfest]

Why

SandboxPolicy is now a legacy compatibility shape, but several tests still built a SandboxPolicy only to immediately convert it into PermissionProfile for APIs that already accept canonical runtime permissions. Those detours make it harder to audit where legacy sandbox policy is still required, because boundary-only usages are mixed together with ordinary test setup.

What Changed

• Updated tests in codex-core, codex-exec, codex-analytics, and codex-config to construct PermissionProfile values directly when the code under test takes a permission profile.
• Changed exec-policy, request-permissions, session, and sandbox test helpers to pass PermissionProfile through instead of converting from SandboxPolicy internally.
• Left SandboxPolicy in place where tests are explicitly exercising legacy compatibility or request/response boundaries.

Test Plan

• cargo test -p codex-analytics -p codex-config
• cargo test -p codex-core --lib safety::tests
• cargo test -p codex-core --lib exec_policy::tests::
• cargo test -p codex-core --lib exec::tests
• cargo test -p codex-core --lib guardian_review_session_config
• cargo test -p codex-core --lib tools::network_approval::tests
• cargo test -p codex-core --lib tools::runtimes::shell::unix_escalation::tests
• cargo test -p codex-core --lib managed_network
• cargo test -p codex-core --test all request_permissions::
• cargo test -p codex-exec sandbox

---

Stack created with Sapling. Best reviewed with ReviewStack.

• test: reduce core sandbox policy test setup #23036
• -> test: construct permission profiles directly #23030