[codex] reduce module visibility (#16978)

## Summary
- reduce public module visibility across Rust crates, preferring private
or crate-private modules with explicit crate-root public exports
- update external call sites and tests to use the intended public crate
APIs instead of reaching through module trees
- add the module visibility guideline to AGENTS.md

## Validation
- `cargo check --workspace --all-targets --message-format=short` passed
before the final fix/format pass
- `just fix` completed successfully
- `just fmt` completed successfully
- `git diff --check` passed

codex-rs/shell-command/src/command_safety/mod.rs

@@ -2,4 +2,4 @@ mod powershell_parser;
 
 pub mod is_dangerous_command;
 pub mod is_safe_command;
-pub mod windows_safe_commands;
+pub(crate) mod windows_safe_commands;

codex-rs/shell-command/src/lib.rs

@@ -3,7 +3,7 @@
 mod shell_detect;
 
 pub mod bash;
-pub mod command_safety;
+pub(crate) mod command_safety;
 pub mod parse_command;
 pub mod powershell;