Honor attachment-owned permissions for MCP servers (#40728)

## Why

MCP servers attached to executor environments must retain their owner's
permission profile instead of inheriting the thread-wide sandbox authority.

## What changed

- Resolve and capture a permission profile for each enabled MCP server when
  publishing the runtime, and reject calls or elicitations when that authority
  is unavailable.
- Use the captured server profile for tool approval decisions, elicitation, and
  sandbox metadata, including after runtime refreshes.
- Materialize `:workspace_roots` from `PathUri` values so permissions preserve
  the path convention of remote executor environments.
- Give threadless app discovery and resource reads an explicit default
  permission profile.

## Testing

Added coverage for per-server elicitation authority, unresolved attachments,
runtime refreshes, restricted tool calls, and foreign-platform workspace roots.

GitOrigin-RevId: 6b188d4b08b29e9971ff7aa68a7785a0cdf9e394

codex-rs/core/src/session/turn_context.rs

@@ -143,14 +143,9 @@ impl TurnEnvironment {
     }
 
     pub(crate) fn permission_profile_with_workspace_roots(&self) -> PermissionProfile {
-        let workspace_roots = self
-            .workspace_roots()
-            .iter()
-            .filter_map(|workspace_root| workspace_root.to_abs_path().ok())
-            .collect::<Vec<_>>();
         self.permission_profile()
             .clone()
-            .materialize_project_roots_with_workspace_roots(&workspace_roots)
+            .materialize_project_roots_with_path_uris(self.workspace_roots())
     }
 
     pub(crate) fn selection(&self) -> TurnEnvironmentSelection {