Enforce environment-specific command policies (#38942)

## What changed

- Add an optional restrictive execution policy to `EnvironmentConfig` and merge it over the active command policy for shell execution and approval decisions.
- Reject environment policies that contain allow rules, so environment configuration can only tighten command access.
- Include the environment policy fingerprint in cached approval keys so policy changes require fresh session approvals.

## Testing

- Cover restrictions overriding saved prefix approvals, policy changes invalidating session approvals, and environment overlays remaining effective when model-specific prefix filtering is active.

GitOrigin-RevId: e94f877549ed5e0f577b8cb52f3c1872c58f029d

codex-rs/core/src/session/environment.rs

@@ -39,6 +39,15 @@ fn validate_environment_config(
             "environment readiness contains more than {MAX_SELECTED_CAPABILITY_ROOTS} selected capability roots"
         )));
     }
+    if config
+        .exec_policy
+        .as_ref()
+        .is_some_and(|policy| !policy.as_ref().get_allowed_prefixes().is_empty())
+    {
+        return Err(CodexErr::InvalidRequest(
+            "environment command policy cannot contain allow rules".to_string(),
+        ));
+    }
 
     let mut root_ids = HashSet::with_capacity(config.selected_capability_roots.len());
     for root in &config.selected_capability_roots {