Use named MITM permissions config

[evawong-oai]

Stack

1. Parent PR: Add MITM hook config model #18868 adds MITM hook config and model only.
2. Parent PR: Wire MITM hooks into runtime enforcement #20659 wires hook enforcement into the proxy request path.
3. This PR changes the user facing PermissionProfile TOML shape.

Why

1. The broader goal is to make MITM clamping usable from the same permission profile that already controls network behavior.
2. This PR is the config UX layer for the stack. It moves MITM policy into [permissions.<profile>.network.mitm] instead of exposing the flat runtime shape to users.
3. The named hook and action tables belong here because users need reusable policy blocks that are easy to review, while the proxy runtime only needs a flat hook list.
4. This PR validates action refs during config parsing so mistakes in the user facing policy fail before a proxy session starts.
5. Keeping the lowering here lets the proxy keep its simpler runtime model and lets PermissionProfile remain the single source of network permission policy.

Summary

1. Keep MITM policy inside [permissions.<profile>.network.mitm] so the selected PermissionProfile owns network proxy policy.
2. Use named MITM hooks under [permissions.<profile>.network.mitm.hooks.<name>].
3. Put host, methods, path prefixes, query, headers, body, and action refs on the hook table.
4. Define reusable action blocks under [permissions.<profile>.network.mitm.actions.<name>].
5. Represent action blocks with NetworkMitmActionToml, then lower them into the proxy runtime action config.
6. Reject unknown refs, empty refs, and empty action blocks during config parsing.
7. Keep the runtime hook model unchanged by lowering config into the existing proxy hook list.
8. Preserve the Wire MITM hooks into runtime enforcement #20659 activation fix for nested MITM policy.

Example

[permissions.workspace.network.mitm]
enabled = true

[permissions.workspace.network.mitm.hooks.github_write]
host = "api.github.com"
methods = ["POST", "PUT"]
path_prefixes = ["/repos/openai/"]
action = ["strip_auth"]

[permissions.workspace.network.mitm.actions.strip_auth]
strip_request_headers = ["authorization"]

Validation

1. Regenerated the config schema.
2. Ran the core MITM config parsing and validation tests.
3. Ran the core PermissionProfile MITM proxy activation tests.
4. Ran the core config schema fixture test.
5. Ran the network proxy MITM policy tests.
6. Ran the scoped Clippy fixer for the network proxy crate.
7. Ran the scoped Clippy fixer for the core crate.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b7da762df6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[winston-openai]

3 things:

1. Codex configs are layered (e.g. system config vs user config). It'd be helpful to allow higher level configs to override the named hook actions. Right now validation is just scoped to the config itself, so an override in a higher level config of just the named action would be thrown away.
2. mitm.enabled seems like it's an implementation detail rather than something we should expose at the config level. I only see 2 cases when we'd want it enabled: hooks exist or mode=limited. The fact someone can disable it during those times feels broken and I can't think of when you'd want to enable it outside of those two settings, so let's just make it conditional and hide it from the user-facing config.
3. More of a nit, but you'd made a previous change to the README based on your older config; we should update that to match this new config

[evawong-oai]

Done.

1. Named actions are now merged across config layers before hooks are lowered. A higher layer action with the same name now wins.
2. I removed the visible mitm.enabled field. MITM is now on when final mode is limited or final hooks exist.
3. The README now uses the named mitm.hooks and mitm.actions tables.

I also kept the external env ordering change out of this stack.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[winston-openai]

I have read the CLA Document and I hereby sign the CLA

[winston-openai]

recheck