fix(cli): preserve ambient Codex filesystem denials

[daneschneider-oai]

Summary

Codex Security uses a generated Codex home. Preserve filesystem denials from the caller's effective Codex permission configuration when starting a scan, without changing the scanner's intended write access.

Changes

• Pin the Codex CLI and TypeScript SDK to the matching 0.148.0-alpha.21 release.
• Pass each scan's filesystem profile through process-local raw SDK overrides instead of rewriting a shared configuration for each turn.
• Carry forward active and explicitly configured deny rules, including inherited profiles, scoped paths, globs, and supported glob-depth settings. Preserve literal paths without silently applying a rule to additional workspace roots.
• Inspect the selected scan profile before starting a turn. Refuse a scan when its restrictions cannot be preserved or organization policy selects an uninspectable profile.
• Include concrete administrator setup steps in the README and link to that guide from the error message. This incorporates the documentation from docs(cli): explain managed permission profile setup #568.
• Keep generated-home authentication, concurrent scans, follow-up turns, and saved explicit scan restrictions working with the same override path.
• Keep the concurrency regression test concurrent while serializing cleanup of its shared temporary home on Windows.

Testing

• bun test --randomize --seed 12345: 1,440 passed, 23 skipped, zero failures.
• pnpm run test (seed 2017813557): 1,440 passed, 23 skipped, zero failures.
• pnpm run types, pnpm run format, and pnpm run build: passed.
• Live codex-cli 0.148.0-alpha.21 permission-profile inspection: accepted the intended literal-path and glob overrides without starting a model turn.
• git diff --check: passed.

Risk and rollout

The administrator guide lands with the runtime change, so its README link resolves when this PR merges. The Codex dependencies remain exact prerelease pins: the published stable 0.148.0 TypeScript SDK does not contain the required raw-override API. Configurations whose deny rules cannot be represented exactly fail before a scan starts. Permission inspection and execution are separate processes, so a concurrent policy change between them is still possible; this is not an atomic runtime enforcement guarantee.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.