app-server: propagate nested experimental gating for AskForApproval::Reject (#14191)

## Summary
This change makes `AskForApproval::Reject` gate correctly anywhere it
appears inside otherwise-stable app-server protocol types.

Previously, experimental gating for `approval_policy: Reject` was
handled with request-specific logic in `ClientRequest` detection. That
covered a few request params types, but it did not generalize to other
nested uses such as `ProfileV2`, `Config`, `ConfigReadResponse`, or
`ConfigRequirements`.

This PR replaces that ad hoc handling with a generic nested experimental
propagation mechanism.

## Testing

seeing this when run app-server-test-client without experimental api
enabled:
```
 initialize response: InitializeResponse { user_agent: "codex-toy-app-server/0.0.0 (Mac OS 26.3.1; arm64) vscode/2.4.36 (codex-toy-app-server; 0.0.0)" }
> {
>   "id": "50244f6a-270a-425d-ace0-e9e98205bde7",
>   "method": "thread/start",
>   "params": {
>     "approvalPolicy": {
>       "reject": {
>         "mcp_elicitations": false,
>         "request_permissions": true,
>         "rules": false,
>         "sandbox_approval": true
>       }
>     },
>     "baseInstructions": null,
>     "config": null,
>     "cwd": null,
>     "developerInstructions": null,
>     "dynamicTools": null,
>     "ephemeral": null,
>     "experimentalRawEvents": false,
>     "mockExperimentalField": null,
>     "model": null,
>     "modelProvider": null,
>     "persistExtendedHistory": false,
>     "personality": null,
>     "sandbox": null,
>     "serviceName": null
>   }
> }
< {
<   "error": {
<     "code": -32600,
<     "message": "askForApproval.reject requires experimentalApi capability"
<   },
<   "id": "50244f6a-270a-425d-ace0-e9e98205bde7"
< }
[verified] thread/start rejected approvalPolicy=Reject without experimentalApi
```

---------

Co-authored-by: celia-oai <celia@openai.com>

codex-rs/app-server-protocol/src/experimental_api.rs

@@ -1,3 +1,6 @@
+use std::collections::BTreeMap;
+use std::collections::HashMap;
+
 /// Marker trait for protocol types that can signal experimental usage.
 pub trait ExperimentalApi {
     /// Returns a short reason identifier when an experimental method or field is
@@ -28,8 +31,34 @@ pub fn experimental_required_message(reason: &str) -> String {
     format!("{reason} requires experimentalApi capability")
 }
 
+impl<T: ExperimentalApi> ExperimentalApi for Option<T> {
+    fn experimental_reason(&self) -> Option<&'static str> {
+        self.as_ref().and_then(ExperimentalApi::experimental_reason)
+    }
+}
+
+impl<T: ExperimentalApi> ExperimentalApi for Vec<T> {
+    fn experimental_reason(&self) -> Option<&'static str> {
+        self.iter().find_map(ExperimentalApi::experimental_reason)
+    }
+}
+
+impl<K, V: ExperimentalApi, S> ExperimentalApi for HashMap<K, V, S> {
+    fn experimental_reason(&self) -> Option<&'static str> {
+        self.values().find_map(ExperimentalApi::experimental_reason)
+    }
+}
+
+impl<K: Ord, V: ExperimentalApi> ExperimentalApi for BTreeMap<K, V> {
+    fn experimental_reason(&self) -> Option<&'static str> {
+        self.values().find_map(ExperimentalApi::experimental_reason)
+    }
+}
+
 #[cfg(test)]
 mod tests {
+    use std::collections::HashMap;
+
     use super::ExperimentalApi as ExperimentalApiTrait;
     use codex_experimental_api_macros::ExperimentalApi;
     use pretty_assertions::assert_eq;
@@ -48,6 +77,27 @@ mod tests {
         StableTuple(u8),
     }
 
+    #[allow(dead_code)]
+    #[derive(ExperimentalApi)]
+    struct NestedFieldShape {
+        #[experimental(nested)]
+        inner: Option<EnumVariantShapes>,
+    }
+
+    #[allow(dead_code)]
+    #[derive(ExperimentalApi)]
+    struct NestedCollectionShape {
+        #[experimental(nested)]
+        inners: Vec<EnumVariantShapes>,
+    }
+
+    #[allow(dead_code)]
+    #[derive(ExperimentalApi)]
+    struct NestedMapShape {
+        #[experimental(nested)]
+        inners: HashMap<String, EnumVariantShapes>,
+    }
+
     #[test]
     fn derive_supports_all_enum_variant_shapes() {
         assert_eq!(
@@ -67,4 +117,56 @@ mod tests {
             None
         );
     }
+
+    #[test]
+    fn derive_supports_nested_experimental_fields() {
+        assert_eq!(
+            ExperimentalApiTrait::experimental_reason(&NestedFieldShape {
+                inner: Some(EnumVariantShapes::Named { value: 1 }),
+            }),
+            Some("enum/named")
+        );
+        assert_eq!(
+            ExperimentalApiTrait::experimental_reason(&NestedFieldShape { inner: None }),
+            None
+        );
+    }
+
+    #[test]
+    fn derive_supports_nested_collections() {
+        assert_eq!(
+            ExperimentalApiTrait::experimental_reason(&NestedCollectionShape {
+                inners: vec![
+                    EnumVariantShapes::StableTuple(1),
+                    EnumVariantShapes::Tuple(2)
+                ],
+            }),
+            Some("enum/tuple")
+        );
+        assert_eq!(
+            ExperimentalApiTrait::experimental_reason(&NestedCollectionShape {
+                inners: Vec::new()
+            }),
+            None
+        );
+    }
+
+    #[test]
+    fn derive_supports_nested_maps() {
+        assert_eq!(
+            ExperimentalApiTrait::experimental_reason(&NestedMapShape {
+                inners: HashMap::from([(
+                    "default".to_string(),
+                    EnumVariantShapes::Named { value: 1 },
+                )]),
+            }),
+            Some("enum/named")
+        );
+        assert_eq!(
+            ExperimentalApiTrait::experimental_reason(&NestedMapShape {
+                inners: HashMap::new(),
+            }),
+            None
+        );
+    }
 }