Support model catalog permission messages (#33147)

## What changed

- Add per-sandbox-mode permission messages to `ModelMessages` and preserve them when applying model configuration overrides.
- Use the selected catalog message in permission instructions, substituting `{{ network_access }}` with the active network policy. Fall back to the existing sandbox text when no override is provided, and allow an empty override to omit only the sandbox section.
- Apply catalog permission messages when a session starts and when its model changes.

## Testing

- Cover catalog deserialization, mode selection, network substitution, fallback and empty-message behavior, remote model catalogs, and model changes.

GitOrigin-RevId: cd5ed3aee3155dca0e7b2358c0f09bae73236856

codex-rs/core/src/context_manager/updates.rs

@@ -46,6 +46,10 @@ fn build_permissions_update_item(
                     .model_messages
                     .as_ref()
                     .and_then(|messages| messages.approvals.as_ref()),
+                next.model_info
+                    .model_messages
+                    .as_ref()
+                    .and_then(|messages| messages.permissions.as_ref()),
             ),
             exec_policy,
             #[allow(deprecated)]

codex-rs/core/src/guardian/review_session.rs

@@ -1414,6 +1414,7 @@ mod tests {
             auto_review: Some(AutoReviewMessages {
                 policy: Some("Use the catalog Guardian policy.".to_string()),
             }),
+            permissions: None,
         };
 
         let guardian_config = build_guardian_review_session_config(
@@ -1441,6 +1442,7 @@ mod tests {
             auto_review: Some(AutoReviewMessages {
                 policy: Some(String::new()),
             }),
+            permissions: None,
         };
 
         let guardian_config = build_guardian_review_session_config(

codex-rs/core/src/session/mod.rs

@@ -3233,6 +3233,11 @@ impl Session {
                             .model_messages
                             .as_ref()
                             .and_then(|messages| messages.approvals.as_ref()),
+                        turn_context
+                            .model_info
+                            .model_messages
+                            .as_ref()
+                            .and_then(|messages| messages.permissions.as_ref()),
                     ),
                     self.services.exec_policy.current().as_ref(),
                     #[allow(deprecated)]