Use ApiPathString in app-server filesystem permission paths

[anp-oai]

Why

Clients running an app-server on one OS and an exec-server on another OS need to be able to pass sandbox config to app-server that refers to resources on the executor's foreign OS.

What

AbsolutePathBuf can't represent these paths and we don't want users to be exposed to PathUri yet, so this moves the public app-server API to be expressed in terms of ApiPathString.

Stacked on #28165.

• change app-server v2 filesystem permission paths, including legacy read/write roots, to ApiPathString
• localize API paths through PathUri when converting into the current native core permission types
• make path-bearing permission conversions fallible and surface localization failures instead of silently treating malformed grants as ordinary denials
• propagate conversion failures through app-server and TUI approval handling
• regenerate the app-server JSON and TypeScript schemas
• leave migration TODOs on native-path conversions so they can be removed once core permission paths use PathUri

[anp-oai]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:84aa89ac79

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".