fix(runner): use the built-in Codex workspace profile

Codex requires custom permission names to have a matching permissions table. Use the documented built-in workspace profile for both thread creation and turn start.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/paperclip-runner/runner/crates/runner-core/src/codex_provider.rs

@@ -229,7 +229,7 @@ impl CodexProvider {
             "cwd": config.cwd,
             "model": config.model,
             "approvalPolicy": config.approval_policy,
-            "permissions": "paperclip-runner-workspace-only",
+            "permissions": ":workspace",
             "runtimeWorkspaceRoots": [config.cwd],
             "baseInstructions": config.instructions,
         });
@@ -303,7 +303,7 @@ impl CodexProvider {
             json!({
                 "threadId": self.thread_id,
                 "cwd": cwd,
-                "permissions": "paperclip-runner-workspace-only",
+                "permissions": ":workspace",
                 "runtimeWorkspaceRoots": [cwd],
                 "input": [{"type": "text", "text": message, "text_elements": []}],
             }),