Honor per-environment permission profiles (#38673)

## What changed

- Add a resolved `permission_profile` to each `EnvironmentConfig` and use the
  complete attachment config for execution and capability-root selection.
- Let `Ready` environment configurations override thread permissions while
  `FromThread` selections continue to inherit them.
- Restrict inherited Guardian environment profiles to read-only permissions.

## Testing

- Add coverage proving that a read-only environment blocks writes even when
  the thread permits workspace writes.
- Update environment inheritance, Guardian review, and capability-root tests
  for the resolved attachment configuration.

GitOrigin-RevId: 1a313b9e4892b1a579a0e880e322a782b4f6c0a7

codex-rs/core/src/session/mcp.rs

@@ -445,13 +445,11 @@ impl Session {
             .selected_capability_roots
             .iter()
             .cloned()
-            .chain(environments.turn_environments().flat_map(|environment| {
-                environment
-                    .config
-                    .selected_capability_roots
-                    .clone()
-                    .unwrap_or_else(|| environment.environment.selected_capability_roots())
-            }))
+            .chain(
+                environments
+                    .turn_environments()
+                    .flat_map(|environment| environment.config.selected_capability_roots.clone()),
+            )
             .enumerate()
         {
             if let Some(kept_location) = root_locations_by_id.get(&root.id) {