Propagate temporary directories into sandbox policy contexts (#40660)

## Why

Filesystem policies containing `:tmpdir` need executor-local directory bindings,
including when execution occurs in a remote environment.

## What changed

- Cache temporary directories reported by remote executors and discover the
  equivalent directories for local environments.
- Preserve the cached directories across inherited environment selection and
  include them in `FileSystemSandboxContext`.
- Add `FileSystemSandboxPolicyContext` and a context accessor so filesystem
  policy entries can be resolved with the executor-owned current directory,
  workspace roots, and temporary directories.

## Testing

Extend environment-selection tests to cover local, remote, and inherited
temporary-directory policy context.

GitOrigin-RevId: 36335af3465c529f024bf69293af288803dd582d

codex-rs/file-system/src/lib.rs

@@ -12,6 +12,7 @@ use codex_protocol::permissions::FileSystemSandboxEntry;
 use codex_protocol::permissions::FileSystemSandboxEntryMissingPathBehavior;
 use codex_protocol::permissions::FileSystemSandboxKind;
 use codex_protocol::permissions::FileSystemSandboxPolicy;
+use codex_protocol::permissions::FileSystemSandboxPolicyContext;
 use codex_protocol::permissions::FileSystemSpecialPath;
 use codex_protocol::permissions::NetworkSandboxPolicy;
 use codex_protocol::protocol::SandboxPolicy;
@@ -332,6 +333,9 @@ pub struct FileSystemSandboxContext {
     pub cwd: Option<PathUri>,
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub workspace_roots: Vec<PathUri>,
+    /// Executor-local default directories used to resolve `:tmpdir` policy entries.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub temporary_directories: Option<Vec<PathUri>>,
     pub windows_sandbox_level: WindowsSandboxLevel,
     #[serde(default)]
     pub windows_sandbox_private_desktop: bool,
@@ -376,6 +380,7 @@ impl FileSystemSandboxContext {
             permissions: permissions.into(),
             cwd,
             workspace_roots,
+            temporary_directories: None,
             windows_sandbox_level: WindowsSandboxLevel::Disabled,
             windows_sandbox_private_desktop: false,
             windows_sandbox_proxy_settings_mode: None,
@@ -393,6 +398,17 @@ impl FileSystemSandboxContext {
             && !file_system_policy.has_full_disk_write_access()
     }
 
+    /// Borrows the executor-owned paths needed to interpret filesystem policy entries.
+    ///
+    /// Returns `None` after the cwd has been omitted from a transport context.
+    pub fn policy_context(&self) -> Option<FileSystemSandboxPolicyContext<'_>> {
+        Some(FileSystemSandboxPolicyContext {
+            cwd: self.cwd.as_ref()?,
+            workspace_roots: &self.workspace_roots,
+            temporary_directories: self.temporary_directories.as_deref(),
+        })
+    }
+
     pub fn has_cwd_dependent_permissions(&self) -> bool {
         match &self.permissions {
             ExecPermissionProfile::Managed {