[codex] reduce module visibility (#16978)

## Summary
- reduce public module visibility across Rust crates, preferring private
or crate-private modules with explicit crate-root public exports
- update external call sites and tests to use the intended public crate
APIs instead of reaching through module trees
- add the module visibility guideline to AGENTS.md

## Validation
- `cargo check --workspace --all-targets --message-format=short` passed
before the final fix/format pass
- `just fix` completed successfully
- `just fmt` completed successfully
- `git diff --check` passed

codex-rs/otel/src/lib.rs

@@ -1,23 +1,27 @@
-pub mod config;
+pub(crate) mod config;
 mod events;
-pub mod metrics;
-pub mod provider;
-pub mod trace_context;
+pub(crate) mod metrics;
+pub(crate) mod provider;
+pub(crate) mod trace_context;
 
 mod otlp;
 mod targets;
 
-use crate::metrics::MetricsError;
 use crate::metrics::Result as MetricsResult;
 use serde::Serialize;
 use strum_macros::Display;
 
+pub use crate::config::OtelExporter;
+pub use crate::config::OtelHttpProtocol;
+pub use crate::config::OtelSettings;
+pub use crate::config::OtelTlsConfig;
 pub use crate::events::session_telemetry::AuthEnvTelemetryMetadata;
 pub use crate::events::session_telemetry::SessionTelemetry;
 pub use crate::events::session_telemetry::SessionTelemetryMetadata;
 pub use crate::metrics::runtime_metrics::RuntimeMetricTotals;
 pub use crate::metrics::runtime_metrics::RuntimeMetricsSummary;
 pub use crate::metrics::timer::Timer;
+pub use crate::metrics::*;
 pub use crate::provider::OtelProvider;
 pub use crate::trace_context::context_from_w3c_trace_context;
 pub use crate::trace_context::current_span_trace_id;