Place host skills before permission instructions (#35661)

## What changed

- Insert the `host_skills` world-state section before the permissions section
  when permissions are present.
- Verify that skill metadata appears before `<permissions instructions>` in the
  rendered developer message.

GitOrigin-RevId: e9fc62f498c384e841fc34ef679850557645f989

codex-rs/core/src/context/world_state/mod.rs

@@ -311,8 +311,14 @@ impl WorldState {
             !self.sections.contains_key(id),
             "duplicate world-state section ID: {id}"
         );
-        self.sections
-            .insert(id, Box::new(ExtensionWorldStateSection(section)));
+        let section = Box::new(ExtensionWorldStateSection(section));
+        if id == "host_skills"
+            && let Some(index) = self.sections.get_index_of(PermissionsState::ID)
+        {
+            self.sections.shift_insert(index, id, section);
+        } else {
+            self.sections.insert(id, section);
+        }
     }
 
     pub(crate) fn snapshot(&self) -> WorldStateSnapshot {

codex-rs/core/tests/suite/client.rs

@@ -2245,6 +2245,11 @@ async fn skills_append_to_developer_message() {
         developer_text.contains("demo: build charts"),
         "expected skill summary: {developer_messages:?}"
     );
+    assert!(
+        developer_text.find("demo: build charts")
+            < developer_text.find("<permissions instructions>"),
+        "host skills should precede permissions: {developer_messages:?}"
+    );
     let expected_path = normalize_path(skill_dir.join("SKILL.md")).unwrap();
     let expected_path_str = expected_path.to_string_lossy().replace('\\', "/");
     assert!(