[codex] allow disabling prompt instruction blocks (#16735)

This PR adds root and profile config switches to omit the generated
`<permissions instructions>` and `<apps_instructions>` prompt blocks
while keeping both enabled by default, and it gates both the initial
developer-context injection and later permissions diff injection so
turning the permissions block off stays effective across turn-context
overrides.

Also added a prompt debug tool that can be used as `codex debug
prompt-input "hello"` and dumps the constructed items list.

codex-rs/core/config.schema.json

@@ -521,6 +521,12 @@
         "include_apply_patch_tool": {
           "type": "boolean"
         },
+        "include_apps_instructions": {
+          "type": "boolean"
+        },
+        "include_permissions_instructions": {
+          "type": "boolean"
+        },
         "js_repl_node_module_dirs": {
           "description": "Ordered list of directories to search for Node modules in `js_repl`.",
           "items": {
@@ -2268,6 +2274,14 @@
       "default": null,
       "description": "Settings that govern if and what will be written to `~/.codex/history.jsonl`."
     },
+    "include_apps_instructions": {
+      "description": "Whether to inject the `<apps_instructions>` developer block.",
+      "type": "boolean"
+    },
+    "include_permissions_instructions": {
+      "description": "Whether to inject the `<permissions instructions>` developer block.",
+      "type": "boolean"
+    },
     "instructions": {
       "description": "System instructions.",
       "type": "string"
@@ -2627,4 +2641,4 @@
   },
   "title": "ConfigToml",
   "type": "object"
-}
+}