fix(cli): preserve ambient Codex filesystem denials

[daneschneider-oai]

Summary

Codex Security uses its own generated Codex home, which previously discarded filesystem denials configured in the user's active Codex permission profile. Preserve those denials automatically while retaining the scanner's existing hardened grants.

Changes

• Import deny rules from the active ambient Codex permission profile, including inherited profiles, legacy none, denied globs, and configured glob depth.
• Preserve workspace-scoped denials across the target repository, original working directory, and configured additional workspace roots.
• Allow explicit --codex and SDK permission settings to add denials without granting additional filesystem access.
• Preserve explicit restrictions across reruns and isolate concurrent scans and follow-up turns that share a generated Codex home.
• Document the updated filesystem-permission behavior and add focused regression coverage.

Testing

• bun test --timeout 30000 ./tests-ts: 1,141 passed, 11 expected platform skips, 7,779 assertions, zero failures.
• Focused ambient-denial, concurrency, and follow-up tests: 14 passed.
• Generated-model verification: passed.
• TypeScript compilation: passed.
• Full Prettier check: passed.
• Real pinned macOS Codex sandbox: protected file access was denied while ordinary file access succeeded.

Risk and rollout

Existing root-read, workspace-write, scan-state, credential-home, and approval-policy controls remain unchanged; callers can only add restrictions. Concurrent scans remain parallel after their subprocess reads its own permission profile. Organization-managed profile allowlists continue to govern profile selection. Windows' unelevated sandbox does not support denied-read rules and will fail safely instead of granting access.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.