[codex] reduce module visibility (#16978)

## Summary
- reduce public module visibility across Rust crates, preferring private
or crate-private modules with explicit crate-root public exports
- update external call sites and tests to use the intended public crate
APIs instead of reaching through module trees
- add the module visibility guideline to AGENTS.md

## Validation
- `cargo check --workspace --all-targets --message-format=short` passed
before the final fix/format pass
- `just fix` completed successfully
- `just fmt` completed successfully
- `git diff --check` passed

codex-rs/codex-mcp/src/lib.rs

@@ -1,2 +1,40 @@
-pub mod mcp;
-pub mod mcp_connection_manager;
+pub(crate) mod mcp;
+pub(crate) mod mcp_connection_manager;
+
+pub use mcp::CODEX_APPS_MCP_SERVER_NAME;
+pub use mcp::McpAuthStatusEntry;
+pub use mcp::McpConfig;
+pub use mcp::McpManager;
+pub use mcp::McpOAuthLoginConfig;
+pub use mcp::McpOAuthLoginSupport;
+pub use mcp::McpOAuthScopesSource;
+pub use mcp::McpSnapshotDetail;
+pub use mcp::ResolvedMcpOAuthScopes;
+pub use mcp::ToolPluginProvenance;
+pub use mcp::canonical_mcp_server_key;
+pub use mcp::collect_mcp_snapshot;
+pub use mcp::collect_mcp_snapshot_from_manager;
+pub use mcp::collect_mcp_snapshot_from_manager_with_detail;
+pub use mcp::collect_mcp_snapshot_with_detail;
+pub use mcp::collect_missing_mcp_dependencies;
+pub use mcp::compute_auth_statuses;
+pub use mcp::configured_mcp_servers;
+pub use mcp::discover_supported_scopes;
+pub use mcp::effective_mcp_servers;
+pub use mcp::group_tools_by_server;
+pub use mcp::oauth_login_support;
+pub use mcp::qualified_mcp_tool_name_prefix;
+pub use mcp::resolve_oauth_scopes;
+pub use mcp::should_retry_without_scopes;
+pub use mcp::split_qualified_tool_name;
+pub use mcp::tool_plugin_provenance;
+pub use mcp::with_codex_apps_mcp;
+pub use mcp_connection_manager::CodexAppsToolsCacheKey;
+pub use mcp_connection_manager::DEFAULT_STARTUP_TIMEOUT;
+pub use mcp_connection_manager::MCP_SANDBOX_STATE_CAPABILITY;
+pub use mcp_connection_manager::MCP_SANDBOX_STATE_METHOD;
+pub use mcp_connection_manager::McpConnectionManager;
+pub use mcp_connection_manager::SandboxState;
+pub use mcp_connection_manager::ToolInfo;
+pub use mcp_connection_manager::codex_apps_tools_cache_key;
+pub use mcp_connection_manager::filter_non_codex_apps_mcp_tools_only;