feat: load defaults into Config and introduce ConfigOverrides (#677)

This changes how instantiating `Config` works and also adds
`approval_policy` and `sandbox_policy` as fields. The idea is:

* All fields of `Config` have appropriate default values.
* `Config` is initially loaded from `~/.codex/config.toml`, so values in
`config.toml` will override those defaults.
* Clients must instantiate `Config` via
`Config::load_with_overrides(ConfigOverrides)` where `ConfigOverrides`
has optional overrides that are expected to be settable based on CLI
flags.

The `Config` should be defined early in the program and then passed
down. Now functions like `init_codex()` take fewer individual parameters
because they can just take a `Config`.

Also, `Config::load()` used to fail silently if `~/.codex/config.toml`
had a parse error and fell back to the default config. This seemed
really bad because it wasn't clear why the values in my `config.toml`
weren't getting picked up. I changed things so that
`load_with_overrides()` returns `Result<Config>` and verified that the
various CLIs print a reasonable error if `config.toml` is malformed.

Finally, I also updated the TUI to show which **sandbox** value is being
used, as we do for other key values like **model** and **approval**.
This was also a reminder that the various values of `--sandbox` are
honored on Linux but not macOS today, so I added some TODOs about fixing
that.

codex-rs/core/src/codex_wrapper.rs

@@ -2,16 +2,13 @@ use std::sync::atomic::AtomicU64;
 use std::sync::Arc;
 
 use crate::config::Config;
-use crate::protocol::AskForApproval;
 use crate::protocol::Event;
 use crate::protocol::EventMsg;
 use crate::protocol::Op;
-use crate::protocol::SandboxPolicy;
 use crate::protocol::Submission;
 use crate::util::notify_on_sigint;
 use crate::Codex;
 use tokio::sync::Notify;
-use tracing::debug;
 
 /// Spawn a new [`Codex`] and initialise the session.
 ///
@@ -19,21 +16,17 @@ use tracing::debug;
 /// is received as a response to the initial `ConfigureSession` submission so
 /// that callers can surface the information to the UI.
 pub async fn init_codex(
-    approval_policy: AskForApproval,
-    sandbox_policy: SandboxPolicy,
+    config: Config,
     disable_response_storage: bool,
-    model_override: Option<String>,
 ) -> anyhow::Result<(CodexWrapper, Event, Arc<Notify>)> {
     let ctrl_c = notify_on_sigint();
-    let config = Config::load().unwrap_or_default();
-    debug!("loaded config: {config:?}");
     let codex = CodexWrapper::new(Codex::spawn(ctrl_c.clone())?);
     let init_id = codex
         .submit(Op::ConfigureSession {
-            model: model_override.or_else(|| config.model.clone()),
-            instructions: config.instructions,
-            approval_policy,
-            sandbox_policy,
+            model: config.model.clone(),
+            instructions: config.instructions.clone(),
+            approval_policy: config.approval_policy,
+            sandbox_policy: config.sandbox_policy,
             disable_response_storage,
         })
         .await?;