app-server: use profile ids in v2 permission params

[bolinfest]

Why

The v2 app-server permission profile fields are experimental, but the previous migration kept a legacy object payload for profile selection. That made clients aware of server-owned activePermissionProfile metadata such as extends, and it kept a legacy_additional_writable_roots path even though runtimeWorkspaceRoots now owns runtime workspace-root selection.

This PR makes the client contract match the intended model: clients select a permission profile by id, and the server resolves and reports active profile provenance in response payloads.

Follow-up to #22611.

What Changed

• Changed thread/start, thread/resume, thread/fork, and turn/start permission profile selection to plain profile id strings.
• Changed command/exec.permissionProfile to a plain profile id string for the same client/server ownership split.
• Removed PermissionProfileSelectionParams and the legacy { type: "profile", modifications: [...] } compatibility deserializer.
• Updated app-server, TUI, and codex exec call sites to send only ids, while keeping activePermissionProfile as server response metadata.
• Updated app-server docs and schema fixtures for the revised command/exec.permissionProfile shape.

Verification

• cargo test -p codex-app-server-protocol
• RUST_MIN_STACK=8388608 cargo test -p codex-app-server
• cargo test -p codex-exec
• RUST_MIN_STACK=8388608 cargo test -p codex-tui

---

Stack created with Sapling. Best reviewed with ReviewStack.

• app-server tests: isolate skill warning fixture #23368
• -> app-server: use profile ids in v2 permission params #23360