Preflight projection can discard the selected profile and active project trust entry

[GautamSharma99]

Summary

The readable preflight configuration truncates profiles and projects by insertion order before validating or prioritizing entries:

scanPreflightCodexConfig lines 1907-1939

Both collections use Object.entries(...).slice(0, 256).

This creates several incorrect projections:

1. config.profile can name a selected profile appearing after entry 256, while that profile's definition is absent from the projected profiles.
2. The current repository's projects[path].trust_level can be omitted because unrelated project entries appeared earlier.
3. Invalid early entries consume the 256-entry input budget even though they are discarded immediately afterward.

The actual Codex invocation still receives configuration resolved from the complete source, so capability preflight can evaluate different effective settings or trust metadata.

Why this matters

Preflight may report readiness or capabilities using the wrong selected-profile configuration. Omitting the active repository trust entry can also change how the preflight helper interprets the repository compared with the real invocation.

Expected behavior

The selected profile and active repository entry should always be represented when valid. Limits should apply to accepted projected entries, not arbitrary raw insertion order.

Suggested direction

Pass the active repository path into projection, reserve entries for the selected profile and repository first, then fill the remaining capacity with validated entries. Alternatively, project only entries that can influence this invocation.

Add regressions with 256 unrelated entries followed by the selected profile/current repository and with invalid entries preceding valid ones.

Found by static audit of upstream main at 9c7634b.