feat(providers): add profile-backed policy visibility

[johntmyers]

Summary

Adds profile-backed provider visibility across the CLI and TUI, expands the built-in Providers v2 profiles, and makes policy inspection show the gateway-composed effective policy by default.

Related Issue

None.

Changes

• Added built-in Providers v2 profiles for codex, copilot, cursor, and pypi, including registration, docs, and profile-list test updates.
• Updated openshell policy get so the default and --rev 0 return the effective gateway policy, while explicit --rev N still returns stored historical revisions.
• Added effective-policy metadata to CLI JSON output and updated policy docs plus architecture notes.
• Made the TUI Providers v2 view read-only, profile-aware, and joined against provider profile metadata.
• Expanded the TUI provider detail modal with scrollable summary sections, raw profile YAML, and redacted raw provider object YAML.
• Improved TUI draft policy rendering to label L4/L7 endpoints and show REST allow/deny rules, query matchers, access, enforcement, TLS, and credential rewrite flags.
• Improved provider list-profiles -o table column sizing for long built-in profile rows.
• Added the Codex provider profile endpoints and binary paths needed for ChatGPT-account Codex CLI use.
• Included a minor sandbox tracing cleanup for PID-limit warnings.

TUI updates:

Providers v2: