docs(cli): explain managed permission profile setup

[daneschneider-oai]

Superseded by #469. The managed-permission-profile README guide is included in that CLI fix so the error message and its documentation ship together.

Summary

Document how administrators can enable Codex Security scans without dropping organization-managed file restrictions.

Changes

• Add a stable managed-permission-profiles section with concrete configuration locations and TOML examples.
• Define the reserved scan-profile placeholder before adding its allowlist entry.
• Explain how to preserve required deny rules when the existing default profile is managed and its rules are not visible to the CLI.
• Keep existing policy settings and link to Codex's configuration and enforcement documentation.

Testing

• Prettier 3.2.5: passed for the README.
• Parsed all three TOML examples with smol-toml and checked the profile, allowlist, default, deny-list, and section anchors.
• Checked the configuration locations against the released Codex source.
• git diff --check: passed.

Risk and rollout

Documentation only; no runtime or policy changes. Examples must be merged into the administrator's existing policy, not used as replacement files. The guide does not recommend weakening restrictions or selecting the placeholder as a default. Land this section before the companion CLI change in #469 ships an error that links to it.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.