[codex] reduce module visibility (#16978)

## Summary
- reduce public module visibility across Rust crates, preferring private
or crate-private modules with explicit crate-root public exports
- update external call sites and tests to use the intended public crate
APIs instead of reaching through module trees
- add the module visibility guideline to AGENTS.md

## Validation
- `cargo check --workspace --all-targets --message-format=short` passed
before the final fix/format pass
- `just fix` completed successfully
- `just fmt` completed successfully
- `git diff --check` passed

codex-rs/execpolicy/src/amend.rs

@@ -9,7 +9,6 @@ use std::path::PathBuf;
 use crate::decision::Decision;
 use crate::rule::NetworkRuleProtocol;
 use crate::rule::normalize_network_rule_host;
-use serde_json;
 use thiserror::Error;
 
 #[derive(Debug, Error)]

codex-rs/execpolicy/src/lib.rs

@@ -1,11 +1,11 @@
-pub mod amend;
-pub mod decision;
-pub mod error;
-pub mod execpolicycheck;
+pub(crate) mod amend;
+pub(crate) mod decision;
+pub(crate) mod error;
+pub(crate) mod execpolicycheck;
 mod executable_name;
-pub mod parser;
-pub mod policy;
-pub mod rule;
+pub(crate) mod parser;
+pub(crate) mod policy;
+pub(crate) mod rule;
 
 pub use amend::AmendError;
 pub use amend::blocking_append_allow_prefix_rule;
@@ -22,6 +22,9 @@ pub use policy::Evaluation;
 pub use policy::MatchOptions;
 pub use policy::Policy;
 pub use rule::NetworkRuleProtocol;
+pub use rule::PatternToken;
+pub use rule::PrefixPattern;
+pub use rule::PrefixRule;
 pub use rule::Rule;
 pub use rule::RuleMatch;
 pub use rule::RuleRef;

codex-rs/execpolicy/src/main.rs

@@ -1,6 +1,6 @@
 use anyhow::Result;
 use clap::Parser;
-use codex_execpolicy::execpolicycheck::ExecPolicyCheckCommand;
+use codex_execpolicy::ExecPolicyCheckCommand;
 
 /// CLI for evaluating exec policies
 #[derive(Parser)]

codex-rs/execpolicy/src/parser.rs

@@ -1,6 +1,5 @@
 use codex_utils_absolute_path::AbsolutePathBuf;
 use multimap::MultiMap;
-use shlex;
 use starlark::any::ProvidesStaticType;
 use starlark::codemap::FileSpan;
 use starlark::environment::GlobalsBuilder;