Carry environment config in turn selections (#38521)

## What changed

- Add `EnvironmentConfigState` to `TurnEnvironmentSelection` so each environment attachment can inherit thread configuration or carry ready configuration for its login-shell policy and selected capability roots.
- Apply ready configuration during thread creation and thread-settings updates while reusing the existing environment connection.
- Validate selection configuration before applying settings, rejecting unsupported pending state and invalid capability roots.

## Testing

- Cover attachment-scoped capability roots, ready configuration at thread startup and turn updates, and rejection of invalid selections without changing existing settings.

GitOrigin-RevId: 86cf8f2148fdaa746ea0dd12890ab7b1577d7587

codex-rs/core/src/session/session.rs

@@ -243,7 +243,22 @@ impl SessionConfiguration {
         }
     }
 
-    pub(super) fn validate_auto_review_requirement(
+    pub(super) fn validate(
+        &self,
+        environments: &[TurnEnvironmentSelection],
+    ) -> ConstraintResult<()> {
+        self.validate_auto_review_requirement(environments)?;
+        super::environment::validate_environment_selections(environments).map_err(|error| {
+            ConstraintError::InvalidValue {
+                field_name: "environments",
+                candidate: "environment configuration".to_string(),
+                allowed: format!("valid selected capability roots ({error})"),
+                requirement_source: codex_config::RequirementSource::Unknown,
+            }
+        })
+    }
+
+    fn validate_auto_review_requirement(
         &self,
         environments: &[TurnEnvironmentSelection],
     ) -> ConstraintResult<()> {
@@ -463,7 +478,7 @@ impl SessionConfiguration {
             .map_or(current_environments, |environments| {
                 environments.environments.as_slice()
             });
-        next_configuration.validate_auto_review_requirement(next_environments)?;
+        next_configuration.validate(next_environments)?;
         Ok(next_configuration)
     }