Codex plugin bypasses project-level Claude Code permission settings (deny rules in .claude/settings.json)

Title: Codex plugin ignores .claude/settings.json deny permissions

Body:

Description

The Codex plugin (codex@openai-codex) does not respect the project-level
permission deny rules defined in .claude/settings.json.

Steps to Reproduce

1. Add a deny rule for a file in the project's .claude/settings.json:

   {
     "permissions": {
       "deny": [
         "Read(pom.xml)"
       ]
     }
   }
   
   

2. Try to read the file directly via Claude Code → correctly blocked

3. Try to read the same file via /codex:rescue → file is read without restriction

Expected Behavior

The Codex plugin should respect the same permission rules that Claude Code enforces.
Deny rules in .claude/settings.json should apply to all plugins equally.

Actual Behavior

The Codex plugin bypasses the deny rules and reads files that are explicitly blocked.

Why This Matters

Project-level deny rules may exist to protect sensitive configuration files
(e.g., DB credentials, internal endpoints). A plugin that silently bypasses
these rules creates a security gap.

Environment

• Claude Code with codex@openai-codex plugin enabled
• Project-level .claude/settings.json with permissions.deny rules

Reproduce the issue with a deny rule in .claude/settings.json, comparing direct Claude Code access with /codex:rescue. Then trace how the Codex plugin handles that entry point and permission checks. Done means the same deny rule blocks the file when accessed through the plugin, with regression coverage for the reported case.