Support forced workspace ids in requirements

Allow requirements.toml and cloud requirements to specify forced_chatgpt_workspace_id using the same single string or array shape as config.toml.

Prefer the requirements value during config resolution, expose it through configRequirements/read, and regenerate app-server schema fixtures.

Document requirements precedence and add targeted coverage for requirements parsing, config resolution, API mapping, and cloud requirements fixtures.

codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json

@@ -106,10 +106,34 @@
             "object",
             "null"
           ]
+        },
+        "forcedChatgptWorkspaceId": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ForcedChatgptWorkspaceIds"
+            },
+            {
+              "type": "null"
+            }
+          ]
         }
       },
       "type": "object"
     },
+    "ForcedChatgptWorkspaceIds": {
+      "anyOf": [
+        {
+          "type": "string"
+        },
+        {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      ],
+      "description": "Workspace IDs that ChatGPT auth is allowed to use.\n\nThe config parser accepts the historical single-string form and the newer list form for deployments that allow multiple ChatGPT workspaces."
+    },
     "NetworkDomainPermission": {
       "enum": [
         "allow",