Validate step settings against proposed permissions (#40647)

## Why

Model requirements must be evaluated against the permissions that will apply
after a settings update. Validating against the current profile can reject a
valid model-and-permission update or allow a later permission-only update to
invalidate the selected model.

## What changed

- Group model, reasoning, service-tier, personality, and approval inputs into
  `StepSettings`, with a single apply-and-validate path.
- Apply permission and environment changes before validating step settings, so
  auto-review requirements use the proposed effective permissions.
- Revalidate existing step settings when permission or environment changes alter
  their constraints, and commit the update only when the complete candidate is
  valid.

## Testing

Added unit and integration coverage for atomic model/permission updates,
permission-only revalidation, environment-derived constraints, and both
standalone and turn-start settings operations.

GitOrigin-RevId: f50dfbd300484a09acc51ee4607278f300ca1cd9

codex-rs/core/src/session/environment.rs

@@ -20,14 +20,21 @@ use crate::session::session::SessionSettingsUpdate;
 
 pub(super) fn validate_environment_selections(
     selections: &[TurnEnvironmentSelection],
-) -> CodexResult<()> {
+) -> ConstraintResult<()> {
     for selection in selections {
         match &selection.config {
             EnvironmentConfigState::FromThread
             | EnvironmentConfigState::Pending
             | EnvironmentConfigState::Failed(_) => {}
             EnvironmentConfigState::Ready(config) => {
-                validate_environment_config(selection, config)?;
+                validate_environment_config(selection, config).map_err(|error| {
+                    ConstraintError::InvalidValue {
+                        field_name: "environments",
+                        candidate: "environment configuration".to_string(),
+                        allowed: format!("valid environment configuration ({error})"),
+                        requirement_source: codex_config::RequirementSource::Unknown,
+                    }
+                })?;
             }
         }
     }