Track permission instructions in world state (#33944)

## What changed

- Model permission instructions as a world-state section keyed by a stable hash of their rendered developer message.
- Re-emit permission context when its model-visible contents change or the retained fragment is missing, while avoiding duplicates when matching instructions already exist in history, including bundled developer messages.
- Normalize CRLF line endings when hashing world-state fragments so equivalent content produces the same snapshot.

## Testing

- Add snapshot coverage for unchanged, changed, absent, and unknown permission state.
- Cover bundled retained permissions and restored world-state baselines during rollout reconstruction.

GitOrigin-RevId: 7d8d212460c1690ca617859f66dcd825987f1e23

codex-rs/core/src/session/snapshots/codex_core__codex_tests__fork_startup_context_then_first_turn_diff.snap

@@ -8,6 +8,7 @@ Scenario: First request after fork when startup preserves the parent baseline, t
 00:message/developer:<PERMISSIONS_INSTRUCTIONS>
 01:message/user:<ENVIRONMENT_CONTEXT:cwd=<CWD>>
 02:message/user:fork seed
-03:message/developer:<PERMISSIONS_INSTRUCTIONS>
-04:message/developer:<collaboration_mode>Fork turn collaboration instructions.</collaboration_mode>
-05:message/user:after fork
+03:message/developer[2]:
+    [01] <PERMISSIONS_INSTRUCTIONS>
+    [02] <collaboration_mode>Fork turn collaboration instructions.</collaboration_mode>
+04:message/user:after fork