Extract codex-config from codex-core (#11389)

`codex-core` had accumulated config loading, requirements parsing,
constraint logic, and config-layer state handling in a single crate.
This change extracts that subsystem into `codex-config` to reduce
`codex-core` rebuild/test surface area and isolate future config work.

## What Changed

### Added `codex-config`

- Added new workspace crate `codex-rs/config` (`codex-config`).
- Added workspace/build wiring in:
  - `codex-rs/Cargo.toml`
  - `codex-rs/config/Cargo.toml`
  - `codex-rs/config/BUILD.bazel`
- Updated lockfiles (`codex-rs/Cargo.lock`, `MODULE.bazel.lock`).
- Added `codex-core` -> `codex-config` dependency in
`codex-rs/core/Cargo.toml`.

### Moved config internals from `core` into `config`

Moved modules to `codex-rs/config/src/`:

- `core/src/config/constraint.rs` -> `config/src/constraint.rs`
- `core/src/config_loader/cloud_requirements.rs` ->
`config/src/cloud_requirements.rs`
- `core/src/config_loader/config_requirements.rs` ->
`config/src/config_requirements.rs`
- `core/src/config_loader/fingerprint.rs` -> `config/src/fingerprint.rs`
- `core/src/config_loader/merge.rs` -> `config/src/merge.rs`
- `core/src/config_loader/overrides.rs` -> `config/src/overrides.rs`
- `core/src/config_loader/requirements_exec_policy.rs` ->
`config/src/requirements_exec_policy.rs`
- `core/src/config_loader/state.rs` -> `config/src/state.rs`

`codex-config` now re-exports this surface from `config/src/lib.rs` at
the crate top level.

### Updated `core` to consume/re-export `codex-config`

- `core/src/config_loader/mod.rs` now imports/re-exports config-loader
types/functions from top-level `codex_config::*`.
- Local moved modules were removed from `core/src/config_loader/`.
- `core/src/config/mod.rs` now re-exports constraint types from
`codex_config`.

codex-rs/core/src/config_loader/mod.rs

@@ -1,14 +1,7 @@
-mod cloud_requirements;
-mod config_requirements;
 mod diagnostics;
-mod fingerprint;
 mod layer_io;
 #[cfg(target_os = "macos")]
 mod macos;
-mod merge;
-mod overrides;
-mod requirements_exec_policy;
-mod state;
 
 #[cfg(test)]
 mod tests;
@@ -16,10 +9,10 @@ mod tests;
 use crate::config::CONFIG_TOML_FILE;
 use crate::config::ConfigToml;
 use crate::config::deserialize_config_toml_with_base;
-use crate::config_loader::config_requirements::ConfigRequirementsWithSources;
 use crate::config_loader::layer_io::LoadedConfigLayers;
 use crate::git_info::resolve_root_git_project_for_trust;
 use codex_app_server_protocol::ConfigLayerSource;
+use codex_config::ConfigRequirementsWithSources;
 use codex_protocol::config_types::SandboxMode;
 use codex_protocol::config_types::TrustLevel;
 use codex_protocol::protocol::AskForApproval;
@@ -33,19 +26,27 @@ use std::path::Path;
 use std::path::PathBuf;
 use toml::Value as TomlValue;
 
-pub use cloud_requirements::CloudRequirementsLoader;
-pub use config_requirements::ConfigRequirements;
-pub use config_requirements::ConfigRequirementsToml;
-pub use config_requirements::ConstrainedWithSource;
-pub use config_requirements::McpServerIdentity;
-pub use config_requirements::McpServerRequirement;
-pub use config_requirements::NetworkConstraints;
-pub use config_requirements::NetworkRequirementsToml;
-pub use config_requirements::RequirementSource;
-pub use config_requirements::ResidencyRequirement;
-pub use config_requirements::SandboxModeRequirement;
-pub use config_requirements::Sourced;
-pub use config_requirements::WebSearchModeRequirement;
+pub use codex_config::CloudRequirementsLoader;
+pub use codex_config::ConfigLayerEntry;
+pub use codex_config::ConfigLayerStack;
+pub use codex_config::ConfigLayerStackOrdering;
+pub use codex_config::ConfigRequirements;
+pub use codex_config::ConfigRequirementsToml;
+pub use codex_config::ConstrainedWithSource;
+pub use codex_config::LoaderOverrides;
+pub use codex_config::McpServerIdentity;
+pub use codex_config::McpServerRequirement;
+pub use codex_config::NetworkConstraints;
+pub use codex_config::NetworkRequirementsToml;
+pub use codex_config::RequirementSource;
+pub use codex_config::ResidencyRequirement;
+pub use codex_config::SandboxModeRequirement;
+pub use codex_config::Sourced;
+pub use codex_config::WebSearchModeRequirement;
+pub(crate) use codex_config::build_cli_overrides_layer;
+pub use codex_config::merge_toml_values;
+#[cfg(test)]
+pub(crate) use codex_config::version_for_toml;
 pub use diagnostics::ConfigError;
 pub use diagnostics::ConfigLoadError;
 pub use diagnostics::TextPosition;
@@ -56,12 +57,6 @@ pub(crate) use diagnostics::first_layer_config_error_from_entries;
 pub use diagnostics::format_config_error;
 pub use diagnostics::format_config_error_with_source;
 pub(crate) use diagnostics::io_error_from_config_error;
-pub use merge::merge_toml_values;
-pub(crate) use overrides::build_cli_overrides_layer;
-pub use state::ConfigLayerEntry;
-pub use state::ConfigLayerStack;
-pub use state::ConfigLayerStackOrdering;
-pub use state::LoaderOverrides;
 
 /// On Unix systems, load default settings from this file path, if present.
 /// Note that /etc/codex/ is treated as a "config folder," so subfolders such
@@ -145,7 +140,7 @@ pub async fn load_config_layers_state(
     let cli_overrides_layer = if cli_overrides.is_empty() {
         None
     } else {
-        let cli_overrides_layer = overrides::build_cli_overrides_layer(cli_overrides);
+        let cli_overrides_layer = build_cli_overrides_layer(cli_overrides);
         let base_dir = cwd
             .as_ref()
             .map(AbsolutePathBuf::as_path)