fix: honor Codex config networking in workspace-write turns

[ma-pony]

Summary

An explicit sandbox_workspace_write.network_access = true reaches Codex session configuration, but ordinary prompts replace it with the mode's hardcoded false. Honor the setting when building workspace-write turn policies, including settings resolved from config.toml for the session's working directory.

workspace-write turn network access
  explicit CODEX_CONFIG boolean
  ?? Codex config/read(cwd) boolean
  ?? existing mode default

Only the network field changes. Preserve writable roots, temporary-directory flags, approval policy/reviewer, shared presets, and other sandbox types. Recheck cancellation after resolving file configuration, so a cancelled prompt cannot start a late turn.

Closes #406. Related to #561 and #368; this proposal also covers file-backed effective configuration, beyond the supplied CODEX_CONFIG object. No new mode, environment variable, dependency, or generated API type is needed.

Evidence

• Before: on upstream 202e66e63343ec4f5a5e35ab590251d813d129ca, the new regression suite had 7 failures / 3 passes. Both explicit-session and file-config enable cases sent networkAccess: false instead of true.
  After: all 10 network-policy cases pass. An additional ACP cancellation test passes while config/read is unresolved and verifies that its eventual response does not start a turn.
• A native Codex configuration probe used an isolated CODEX_HOME and the real config/read RPC: a TOML network flag produced workspaceWrite with networkAccess: true. runTurn was intercepted, so this made zero model requests; it is not a provider-backed networking E2E claim.
• npm run typecheck, npm run build, and git diff --check pass.
• Full npm test: 1,497 passed, 36 skipped, 3 failed. The same three CodexHomeWatcher filesystem-notification tests fail on the unmodified upstream SHA in this macOS environment (7 passed / 3 failed when isolated). This PR does not change the watcher.
• npm run bundle:all passed with the CI-pinned Bun 1.3.11 for all six targets: Linux, macOS, and Windows, each x64/arm64. The native macOS arm64 executable also passed --version.
• Provider-backed E2E was not run.

Merge Danger

Door: Two-way

No persisted state or protocol schema changes. Reverting restores the old turn-policy mapping.

Blast Radius: Workspace

Workspace-write turns now follow explicitly configured networking. Read-only/full-access and users without a configured network flag retain their previous policy. The only new RPC is a read-only config/read when CODEX_CONFIG does not supply a valid boolean.