[codex] reduce module visibility (#16978)

## Summary
- reduce public module visibility across Rust crates, preferring private
or crate-private modules with explicit crate-root public exports
- update external call sites and tests to use the intended public crate
APIs instead of reaching through module trees
- add the module visibility guideline to AGENTS.md

## Validation
- `cargo check --workspace --all-targets --message-format=short` passed
before the final fix/format pass
- `just fix` completed successfully
- `just fmt` completed successfully
- `git diff --check` passed

codex-rs/response-debug-context/src/lib.rs

@@ -1,6 +1,6 @@
 use base64::Engine;
+use codex_api::ApiError;
 use codex_api::TransportError;
-use codex_api::error::ApiError;
 
 const REQUEST_ID_HEADER: &str = "x-request-id";
 const OAI_REQUEST_ID_HEADER: &str = "x-oai-request-id";
@@ -91,8 +91,8 @@ mod tests {
     use super::extract_response_debug_context;
     use super::telemetry_api_error_message;
     use super::telemetry_transport_error_message;
+    use codex_api::ApiError;
     use codex_api::TransportError;
-    use codex_api::error::ApiError;
     use http::HeaderMap;
     use http::HeaderValue;
     use http::StatusCode;