Remove generated-default filesystem path variants (#33632)

## What changed

- Represent built-in filesystem policy entries with the same `Path` and
  `Special` variants used by other entries.
- Remove generated-default filtering from Windows sandbox policy resolution and
  simplify elevated deny-write handling to rely on direct-runtime enforcement
  and the legacy policy projection.
- Update protocol conversions, policy transforms, and profile expectations for
  the reduced filesystem path model.

GitOrigin-RevId: a65793e6855a03d52a575e82cb3d4b9b2e32db5c

codex-rs/core/src/config/config_tests.rs

@@ -4167,7 +4167,7 @@ exclude_slash_tmp = true
                         file_system_policy
                             .entries
                             .contains(&FileSystemSandboxEntry {
-                                path: FileSystemPath::GeneratedDefaultPath {
+                                path: FileSystemPath::Path {
                                     path: AbsolutePathBuf::resolve_path_against_base(
                                         subpath,
                                         cwd.path()

codex-rs/core/src/config/permissions.rs

@@ -249,8 +249,6 @@ fn insert_filesystem_permission_toml(
         FileSystemPath::Special { value } => {
             insert_special_filesystem_permission_toml(entries, value, entry.access);
         }
-        FileSystemPath::GeneratedDefaultPath { .. }
-        | FileSystemPath::GeneratedDefaultSpecial { .. } => {}
     }
 }