Fix MCP permission policy sync

[leoshimo-oai]

Why/Context/Summary

Repro: start a session outside Full Access, switch permissions to Full Access, then submit a new turn that triggers MCP/CUA permission handling.

The turn used the live Full Access SessionConfiguration, but the MCP coordinator was still synced from the stale original_config_do_not_use / per-turn config copy. That left the coordinator with an old sandbox policy, so empty MCP permission elicitations could be denied instead of auto-accepted.

Fix: update/rebuild the MCP connection manager from the live turn/session approval and sandbox policy fields.

Test plan

just fmt
cargo test -p codex-core --lib
cargo test -p codex-core --lib mcp_tool_call::tests