[codex] reduce module visibility (#16978)

## Summary
- reduce public module visibility across Rust crates, preferring private
or crate-private modules with explicit crate-root public exports
- update external call sites and tests to use the intended public crate
APIs instead of reaching through module trees
- add the module visibility guideline to AGENTS.md

## Validation
- `cargo check --workspace --all-targets --message-format=short` passed
before the final fix/format pass
- `just fix` completed successfully
- `just fmt` completed successfully
- `git diff --check` passed

codex-rs/codex-api/src/endpoint/realtime_websocket/mod.rs

@@ -1,14 +1,12 @@
-pub mod methods;
+pub(crate) mod methods;
 mod methods_common;
 mod methods_v1;
 mod methods_v2;
-pub mod protocol;
+pub(crate) mod protocol;
 mod protocol_common;
 mod protocol_v1;
 mod protocol_v2;
 
-pub use codex_protocol::protocol::RealtimeAudioFrame;
-pub use codex_protocol::protocol::RealtimeEvent;
 pub use methods::RealtimeWebsocketClient;
 pub use methods::RealtimeWebsocketConnection;
 pub use methods::RealtimeWebsocketEvents;