Fix Codex resume config replay and simplify permission handling

Replay saved config overrides in the resume/fork scope so launch reasoning
settings survive a conflicting Codex default. Preserve user developer
instructions and positional prompts when rebuilding the bootstrap.

Remove codex_sandbox_mode and let native Codex settings select sandbox and
approval policy. Keep native --add-dir and the terminal socket-access
default, respecting explicit network overrides. Remove unused home wrappers.

Validate with full just ci (10 steps), Codex 0.159.2 lifecycle regression,
and live native-policy, network-override, and nested-launch checks.

Fixes #147