[codex] reduce module visibility (#16978)

## Summary
- reduce public module visibility across Rust crates, preferring private
or crate-private modules with explicit crate-root public exports
- update external call sites and tests to use the intended public crate
APIs instead of reaching through module trees
- add the module visibility guideline to AGENTS.md

## Validation
- `cargo check --workspace --all-targets --message-format=short` passed
before the final fix/format pass
- `just fix` completed successfully
- `just fmt` completed successfully
- `git diff --check` passed

codex-rs/rollout/src/lib.rs

@@ -4,12 +4,12 @@ use std::sync::LazyLock;
 
 use codex_protocol::protocol::SessionSource;
 
-pub mod config;
-pub mod list;
-pub mod metadata;
-pub mod policy;
-pub mod recorder;
-pub mod session_index;
+pub(crate) mod config;
+pub(crate) mod list;
+pub(crate) mod metadata;
+pub(crate) mod policy;
+pub(crate) mod recorder;
+pub(crate) mod session_index;
 pub mod state_db;
 
 pub(crate) mod default_client {
@@ -30,14 +30,28 @@ pub static INTERACTIVE_SESSION_SOURCES: LazyLock<Vec<SessionSource>> = LazyLock:
 });
 
 pub use codex_protocol::protocol::SessionMeta;
+pub use config::Config;
 pub use config::RolloutConfig;
 pub use config::RolloutConfigView;
+pub use list::Cursor;
+pub use list::ThreadItem;
+pub use list::ThreadListConfig;
+pub use list::ThreadListLayout;
+pub use list::ThreadSortKey;
+pub use list::ThreadsPage;
 pub use list::find_archived_thread_path_by_id_str;
 pub use list::find_thread_path_by_id_str;
 #[deprecated(note = "use find_thread_path_by_id_str")]
 pub use list::find_thread_path_by_id_str as find_conversation_path_by_id_str;
+pub use list::get_threads;
+pub use list::get_threads_in_root;
+pub use list::parse_cursor;
+pub use list::read_head_for_summary;
+pub use list::read_session_meta_line;
 pub use list::rollout_date_parts;
+pub use metadata::builder_from_items;
 pub use policy::EventPersistenceMode;
+pub use policy::should_persist_response_item_for_memories;
 pub use recorder::RolloutRecorder;
 pub use recorder::RolloutRecorderParams;
 pub use session_index::append_thread_name;

codex-rs/rollout/src/metadata.rs

@@ -137,7 +137,7 @@ pub(crate) async fn backfill_sessions(
     runtime: &codex_state::StateRuntime,
     config: &impl RolloutConfigView,
 ) {
-    let metric_client = codex_otel::metrics::global();
+    let metric_client = codex_otel::global();
     let timer = metric_client
         .as_ref()
         .and_then(|otel| otel.start_timer(DB_METRIC_BACKFILL_DURATION_MS, &[]).ok());