Show current permissions/approval mode in the TUI status line

What problem are you trying to solve?

When using Codex TUI, the current permissions/approval mode can be changed during a session with /permissions, but it is not visible in the status line afterward.

This makes it easy to lose track of whether the current session is running with a restrictive approval profile, on-request, never, danger-full-access, etc. That state is important because it changes how much autonomy Codex has and how much risk a command can carry.

Proposed solution

Add one or more built-in tui.status_line items that render the current permission state, for example:

[tui]
status_line = ["current-dir", "model-with-reasoning", "permission-profile", "approval-policy", "sandbox-mode", "context-used"]

Possible fields:

• permission-profile: compact display of the active permission profile, especially when named profiles are used.
• approval-policy: current approval policy, such as on-request or never.
• sandbox-mode: current sandbox mode, such as workspace-write or danger-full-access.

A compact combined item would also work, e.g. permissions, displayed as workspace-write / on-request or danger-full-access / never.

Current behavior

Trying likely item names such as these in ~/.codex/config.toml causes the status line configuration to fail because they are not supported status-line items:

status_line = ["sandbox", "approval-policy", "current-dir", "model-with-reasoning"]

Why this matters

The permission/approval state is safety-critical session context. It should be glanceable in the same place as model, directory, context usage, and rate limits, especially after changing it with /permissions inside the TUI.

Environment

Observed in Codex TUI v0.133.0-alpha.1 on macOS.