Every Codex turn/start sent a legacy sandboxPolicy. Codex keeps a user's
named permission profile (default_permissions) only while that policy
matches the profile's projection, so after a Full access turn the next
Auto turn fell back to a plain workspaceWrite profile and lost the
profile's deny-read entries, such as .env files.

The adapter now remembers the user-defined activePermissionProfile that
thread/start and thread/resume report. When a turn's mode uses the same
sandbox type and no explicit sandbox override is given, turn/start selects
the profile with `permissions` instead of sending sandboxPolicy. Built-in
profiles and Codex versions without activePermissionProfile are unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>