Default Agent prompts overwrite configured writable roots and sandbox permissions

[jbellis]

Ordinary ACP prompts silently replace the user's configured Codex sandbox with the selected mode's hardcoded sandbox. In addition to the network failure described in #406, this drops configured writable roots and breaks tools that use a shared build/cache directory outside the checkout.

Reproduction

1. Create a writable directory outside the checkout and outside /tmp, for example /home/me/shared-build-cache.

2. Configure the Codex home used by the ACP server:

   [sandbox_workspace_write]
   writable_roots = ["/home/me/shared-build-cache"]
   network_access = true

3. Open or resume a session through codex-acp in its default Agent mode, without explicitly asking to change permissions.

4. Send an ordinary prompt that writes a small file in that cache directory.

Expected: Codex retains the resolved configured writable root and network setting.

Observed: the turn records sandbox_policy with writable_roots: [] and network_access: false. Writes to the cache fail with Read-only file system (os error 30). In our Hel ACP client, this breaks the globally installed mbx Cargo wrapper, even though the cache directory is explicitly permitted in the selected Codex home's config. The effective filesystem permission profile in the rollout also omits the cache root.

Cause

Verified the per-turn overwrite is still present on upstream main at 061f9a4a2e463a220d7a3ab2ae5e9732837085ef: sendPrompt, mode presets.

AgentMode constructs a workspace-write sandbox with empty writable roots and network disabled. CodexAcpClient.sendPrompt() supplies that sandbox in every turn/start; addAdditionalDirectoriesToSandboxPolicy() adds ACP additional directories, but not the roots resolved from Codex configuration.

The sandboxPolicy and approvalPolicy fields of turn/start are optional overrides. The Codex thread start/resume response supplies the resolved sandbox and approval policy, but the bridge does not retain those as the default prompt policy. Hel receives mode/config-option selectors through ACP, not the complete resolved sandbox, so it cannot simply echo the correct permissions back.

Requested fix

Preserve Codex's resolved permissions for ordinary prompts unless the client/user explicitly changes permissions. Either omit the optional per-turn overrides when no change is requested, or retain and reuse the resolved policy. Handle explicit mode changes separately, and cover both new and resumed threads.

A regression test should open a thread with a configured writable root and network enabled, send a prompt, and assert that the effective policy still contains both. ACP additionalDirectories should continue to work without replacing configured roots.

Related: #406 (network access) and #310 (approval policy). A network-enabled preset alone would not fix the writable-roots loss. We are temporarily selecting agent-full-access from Hel to keep builds working, but want to remove that workaround once configured permissions survive prompts.