Preserve environment configuration ownership (#38678)

## Why

Environment attachments can either inherit configuration from their thread or
provide their own. Later thread setting updates must refresh inherited
configuration without overwriting attachment-owned permissions and capability
roots.

## What changed

- Resolve each attachment's configuration when it is selected and retain
  whether it came from the thread or the attachment owner.
- Apply subsequent thread configuration updates only to thread-owned
  attachments, while preserving ownership across snapshots and child threads.
- Keep the resolved configuration with the environment selection so runtime
  consumers use a single canonical value.

## Testing

- Extend remote-environment coverage to verify that thread-owned permissions
  follow thread updates while owner-provided read-only permissions remain in
  effect.
- Cover configuration inheritance, attachment replacement, and owner-configured
  capability roots.

GitOrigin-RevId: fe70c4be5f151432b69bf4b141e316faa89036ae

codex-rs/core/src/session/mod.rs

@@ -1596,7 +1596,7 @@ impl Session {
             } else if state.session_configuration.turn_environment_config() != environment_config {
                 self.services
                     .turn_environments
-                    .update_environment_configs(&environment_config);
+                    .update_thread_config(&environment_config);
             }
             state.session_configuration = updated;
             let new_config = notify_config_contributors