T3 resumes a loaded Codex thread before every turn whose runtime settings
changed. That thread/resume response reports the thread's current state,
which has no active permission profile after a Full access (or any legacy
sandboxPolicy) turn, so the adapter forgot the user's profile and the next
Auto turn fell back to sandboxPolicy, dropping the profile's .env denies.

A response without a user-defined profile now leaves the remembered one in
place. The round-trip test now issues the thread/resume calls T3 really
makes between turns.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>