[codex] adjust apply_patch file replacement behavior

[bookholt-oai]

Summary

• Normalize how apply_patch replaces pre-existing write targets before persisting new content.
• Add regression coverage for replacement semantics in direct CLI and integration paths.
• Keep the change scoped to write-path behavior and associated tests.

Validation

• cargo test -p codex-apply-patch
• cargo test -p codex-core --test all apply_patch_cli_does_not_write_through_symlink_escape_outside_workspace
• just fmt
• just fix -p codex-apply-patch

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}