Why

Skills loading had started to pass raw AbsolutePathBuf values separately from the ExecutorFileSystem that actually owns those paths. That is unsafe once Codex can have more than one execution environment: the same absolute path string can refer to different files depending on whether it is read through the local filesystem or a selected remote environment.

This PR makes that authority explicit at the skills boundary. Skill code now receives a bound path object instead of reconstructing (filesystem, path) pairs ad hoc, so repo/workspace skill reads stay attached to the selected environment while client-local skill sources do not accidentally get read from a remote filesystem.

What Changed

• Added public codex_exec_server::EnvironmentPathRef, a small bound-path primitive for (Arc<dyn ExecutorFileSystem>, AbsolutePathBuf) with path helpers plus filesystem-backed read_to_string, metadata, and read_directory methods.
• Moved skills loading to carry EnvironmentPathRef through SkillRoot, SkillsLoadInput, loader traversal, cache keys, and plugin skill reads instead of splitting filesystem/path authority at callsites.
• Split skill root authority intentionally:
  • repo/workspace roots such as project .codex/skills and repo .agents/skills use the selected environment path
  • local user/system/plugin roots use the available local filesystem only
  • when local exec is disabled, local absolute roots are skipped instead of falling back to LOCAL_FS
• Updated turn/session skill loading to construct the selected environment path from the resolved primary turn environment, while still using the local filesystem for local user/system/plugin skill roots when available.
• Kept plugin skill metadata loading local-only for now, with TODOs marking the future multi-environment plugin-loading follow-up.
• Added backwards-compatible skills/list.environmentId request selection. When present, skills/list scans cwd entries using that environment; when omitted, it keeps the legacy implicit-local behavior. If omitted while local exec is disabled, the API now returns an empty catalog instead of silently switching to another environment.
• Updated the app-server schema/docs and focused tests for the new skills/list request shape and local-disabled behavior.

Verification

• Added EnvironmentPathRef unit coverage for filesystem identity/hash behavior and sandbox forwarding.
• Added skills loader/manager coverage that repo roots stay bound to the selected environment filesystem while local roots use the local filesystem and are skipped when local exec is unavailable.
• Added app-server skills/list coverage for explicit environmentId serialization and the implicit-local-disabled empty-catalog case.