Make deny canonical for filesystem permission entries (#23493)

## Why
Filesystem permission profiles used `none` for deny-read entries, which
is less direct than the action the entry actually represents. This
change makes `deny` the canonical filesystem permission spelling while
preserving compatibility for older configs that still send `none`.

## What changed
- rename `FileSystemAccessMode::None` to `Deny`
- serialize and generate schemas with `deny` as the canonical value
- retain `none` only as a legacy input alias for temporary config
compatibility
- update filesystem glob diagnostics and regression coverage to use the
canonical spelling
- refresh config and app-server schema fixtures to match the new wire
shape

## Validation
- `cargo test -p codex-protocol`
- `cargo test -p codex-app-server-protocol`
- `cargo test -p codex-core config_toml_deserializes_permission_profiles
--lib`
- `cargo test -p codex-core
read_write_glob_patterns_still_reject_non_subpath_globs --lib`

Earlier in the session, a broad `cargo test -p codex-core` run reached
unrelated pre-existing failures in timing/snapshot/git-info tests under
this environment; the targeted surfaces touched by this PR passed
cleanly.

codex-rs/core/tests/suite/apply_patch_cli.rs

@@ -148,7 +148,7 @@ fn workspace_write_with_unreadable_path(unreadable_path: AbsolutePathBuf) -> Per
             path: FileSystemPath::Path {
                 path: unreadable_path,
             },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         },
         FileSystemSandboxEntry {
             path: FileSystemPath::Special {

codex-rs/core/tests/suite/tools.rs

@@ -380,7 +380,7 @@ async fn shell_command_enforces_glob_deny_read_policy() -> Result<()> {
                     path: FileSystemPath::GlobPattern {
                         pattern: format!("{}/**/*.env", config.cwd.as_path().display()),
                     },
-                    access: FileSystemAccessMode::None,
+                    access: FileSystemAccessMode::Deny,
                 });
             config
                 .permissions

codex-rs/core/tests/suite/unified_exec.rs

@@ -2774,7 +2774,7 @@ async fn unified_exec_enforces_glob_deny_read_policy() -> Result<()> {
                 path: FileSystemPath::GlobPattern {
                     pattern: format!("{}/**/*.env", config.cwd.as_path().display()),
                 },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             });
         config
             .permissions

codex-rs/core/tests/suite/view_image.rs

@@ -527,7 +527,7 @@ async fn view_image_tool_applies_local_sandbox_read_denies() -> anyhow::Result<(
             path: FileSystemPath::Path {
                 path: denied_path.clone(),
             },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         });
     let permission_profile = PermissionProfile::from_runtime_permissions(
         &file_system_sandbox_policy,

codex-rs/core/tests/suite/windows_sandbox.rs

@@ -91,13 +91,13 @@ async fn windows_restricted_token_rejects_exact_and_glob_deny_read_policy() -> a
             path: FileSystemPath::GlobPattern {
                 pattern: "**/*.env".to_string(),
             },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         },
         FileSystemSandboxEntry {
             path: FileSystemPath::Path {
                 path: future_secret,
             },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         },
     ]);
     let permission_profile = PermissionProfile::from_runtime_permissions(
@@ -173,11 +173,11 @@ async fn windows_elevated_enforces_exact_and_glob_deny_read_policy() -> anyhow::
             path: FileSystemPath::GlobPattern {
                 pattern: "**/*.env".to_string(),
             },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         },
         FileSystemSandboxEntry {
             path: FileSystemPath::Path { path: exact_secret },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         },
     ]);
     let permission_profile = PermissionProfile::from_runtime_permissions(