Enforce filesystem permissions when loading AGENTS.md (#39653)

## Why

Project instructions must respect the selected environment's filesystem read
permissions. Tightening those permissions for a later turn must not allow
previously cached instructions to reach the model.

## What changed

- Apply each environment's filesystem sandbox while discovering and reading
  `AGENTS.md` files.
- Fail thread or turn setup when sandboxing blocks a discovered instruction
  file, while allowing a restricted project with no instructions to start.
- Clear cached instructions before refresh and include the Windows sandbox
  level in the cache key.
- Ignore inaccessible ancestor marker probes so readable instructions in the
  selected working directory can still load.

## Testing

Added coverage for restricted projects, denied instruction files, cache
invalidation after permissions tighten, and unreadable ancestor markers.

GitOrigin-RevId: 6ea1a27b9c873a6260e4f87d42ae1317a6a4ae4b

codex-rs/app-server/tests/suite/v2/thread_start.rs

@@ -1840,6 +1840,11 @@ fn create_config_toml_with_profile_workspace_root(
 [permissions.dev.workspace_roots]
 "{profile_root_key}" = true
 
+# This test only exercises workspace roots; Windows restricted-token sandboxes
+# cannot enforce a filesystem policy without root read access.
+[permissions.dev.filesystem]
+":root" = "read"
+
 [permissions.dev.filesystem.":workspace_roots"]
 "." = "write"
 "#,

codex-rs/app-server/tests/suite/v2/turn_start.rs

@@ -2828,6 +2828,11 @@ wire_api = "responses"
 request_max_retries = 0
 stream_max_retries = 0
 
+# This test only exercises writable workspace roots; the Windows restricted-token
+# sandbox cannot enforce a filesystem policy without root read access.
+[permissions.dev.filesystem]
+":root" = "read"
+
 [permissions.dev.filesystem.":workspace_roots"]
 "." = "write"
 "#