fix: keep permissions profiles forward compatible

[viyatb-oai]

Summary

• preserve unknown :special_path tokens, including nested entries, so older Codex builds warn and ignore instead of failing config load
• fail closed with a startup warning when a permissions profile has missing or empty filesystem entries instead of aborting profile compilation
• normalize Windows verbatim paths like \?\C:\... before absolute-path validation while keeping explicit errors for truly invalid paths

Testing

• just fmt
• cargo test -p codex-core permissions_profiles_allow
• cargo test -p codex-core normalize_absolute_path_for_platform_simplifies_windows_verbatim_paths
• cargo test -p codex-protocol unknown_special_paths_are_ignored_by_legacy_bridge
• cargo clippy -p codex-core -p codex-protocol --all-targets -- -D warnings
• cargo clean