Issue #20266 runtime transcript (fs-28, Linux x86_64, Codex CLI 0.163.0)

Setup
- T3 web dev client (`vp run dev` in the worktree, isolated .t3 state), Codex provider,
  CODEX_HOME pointing at a scratch home whose config.toml adds the reporter's profile:

    default_permissions = "env-protected"
    [permissions.env-protected]
    extends = ":workspace"
    [permissions.env-protected.filesystem.":workspace_roots"]
    "**/.env" = "deny"
    "**/.env*" = "deny"

- Steps (one new thread each run): runtime mode Auto, send "Reply with exactly: OK. Do not run
  any commands."; switch to Full access, send the same; switch back to Auto, send the same.
- Read back from Codex's own rollout file for the thread: each turn's injected
  <permissions instructions> block and the turn_context permission_profile Codex enforces.
- Codex's request log for the fixed run shows the sequence T3 sends:
  thread/start, turn/start, thread/resume, turn/start, thread/resume, turn/start.

Before: origin/main ed3f965e07
  turn 1 Auto        permission block .env denies: ['<cwd>/**/.env', '<cwd>/**/.env*']
                     enforced profile .env denies: ['<cwd>/**/.env', '<cwd>/**/.env*']
  turn 2 Full access permission block .env denies: []   (danger-full-access, expected)
  turn 3 Auto        permission block .env denies: []   <- bug
                     enforced profile .env denies: []   <- bug (turn_context has no active_permission_profile)

After: fix/issue-20266 (41f688b86b; restart and fallback runs on 862dab68ab)
  turn 1 Auto        permission block .env denies: ['<cwd>/**/.env', '<cwd>/**/.env*']
                     enforced profile .env denies: ['<cwd>/**/.env', '<cwd>/**/.env*']
  turn 2 Full access permission block .env denies: []   (danger-full-access, expected)
  turn 3 Auto        permission block .env denies: ['<cwd>/**/.env', '<cwd>/**/.env*']
                     enforced profile .env denies: ['<cwd>/**/.env', '<cwd>/**/.env*']

Extra runs on the fix:
  - Full access turn, then T3 server restart, then Auto: the Auto turn's block and enforced profile
    list both .env denies (cold thread/resume reports the configured profile).
  - Profile renamed in config.toml while the thread stays loaded, then Auto: Codex rejects
    turn/start with permissions="env-protected" ("default_permissions refers to undefined
    profile"), T3 retries once with the legacy sandboxPolicy, the turn completes.
  - On the fix, turn 1's enforced profile lists each deny glob twice (the profile is selected
    on top of the identical thread default); the permission block lists each once.

<cwd> = the project's working directory (/home/ubuntu/wt/issue-20266/apps/server in this run).
No protected file was read in any run.