app-server: propagate nested experimental gating for AskForApproval::Reject (#14191)

## Summary
This change makes `AskForApproval::Reject` gate correctly anywhere it
appears inside otherwise-stable app-server protocol types.

Previously, experimental gating for `approval_policy: Reject` was
handled with request-specific logic in `ClientRequest` detection. That
covered a few request params types, but it did not generalize to other
nested uses such as `ProfileV2`, `Config`, `ConfigReadResponse`, or
`ConfigRequirements`.

This PR replaces that ad hoc handling with a generic nested experimental
propagation mechanism.

## Testing

seeing this when run app-server-test-client without experimental api
enabled:
```
 initialize response: InitializeResponse { user_agent: "codex-toy-app-server/0.0.0 (Mac OS 26.3.1; arm64) vscode/2.4.36 (codex-toy-app-server; 0.0.0)" }
> {
>   "id": "50244f6a-270a-425d-ace0-e9e98205bde7",
>   "method": "thread/start",
>   "params": {
>     "approvalPolicy": {
>       "reject": {
>         "mcp_elicitations": false,
>         "request_permissions": true,
>         "rules": false,
>         "sandbox_approval": true
>       }
>     },
>     "baseInstructions": null,
>     "config": null,
>     "cwd": null,
>     "developerInstructions": null,
>     "dynamicTools": null,
>     "ephemeral": null,
>     "experimentalRawEvents": false,
>     "mockExperimentalField": null,
>     "model": null,
>     "modelProvider": null,
>     "persistExtendedHistory": false,
>     "personality": null,
>     "sandbox": null,
>     "serviceName": null
>   }
> }
< {
<   "error": {
<     "code": -32600,
<     "message": "askForApproval.reject requires experimentalApi capability"
<   },
<   "id": "50244f6a-270a-425d-ace0-e9e98205bde7"
< }
[verified] thread/start rejected approvalPolicy=Reject without experimentalApi
```

---------

Co-authored-by: celia-oai <celia@openai.com>

codex-rs/codex-experimental-api-macros/src/lib.rs

@@ -37,8 +37,7 @@ fn derive_for_struct(input: &DeriveInput, data: &DataStruct) -> TokenStream {
             let mut experimental_fields = Vec::new();
             let mut registrations = Vec::new();
             for field in &named.named {
-                let reason = experimental_reason(&field.attrs);
-                if let Some(reason) = reason {
+                if let Some(reason) = experimental_reason(&field.attrs) {
                     let expr = experimental_presence_expr(field, false);
                     checks.push(quote! {
                         if #expr {
@@ -65,6 +64,17 @@ fn derive_for_struct(input: &DeriveInput, data: &DataStruct) -> TokenStream {
                             }
                         });
                     }
+                } else if has_nested_experimental(field) {
+                    let Some(ident) = field.ident.as_ref() else {
+                        continue;
+                    };
+                    checks.push(quote! {
+                        if let Some(reason) =
+                            crate::experimental_api::ExperimentalApi::experimental_reason(&self.#ident)
+                        {
+                            return Some(reason);
+                        }
+                    });
                 }
             }
             (checks, experimental_fields, registrations)
@@ -74,8 +84,7 @@ fn derive_for_struct(input: &DeriveInput, data: &DataStruct) -> TokenStream {
             let mut experimental_fields = Vec::new();
             let mut registrations = Vec::new();
             for (index, field) in unnamed.unnamed.iter().enumerate() {
-                let reason = experimental_reason(&field.attrs);
-                if let Some(reason) = reason {
+                if let Some(reason) = experimental_reason(&field.attrs) {
                     let expr = index_presence_expr(index, &field.ty);
                     checks.push(quote! {
                         if #expr {
@@ -100,6 +109,15 @@ fn derive_for_struct(input: &DeriveInput, data: &DataStruct) -> TokenStream {
                             }
                         }
                     });
+                } else if has_nested_experimental(field) {
+                    let index = syn::Index::from(index);
+                    checks.push(quote! {
+                        if let Some(reason) =
+                            crate::experimental_api::ExperimentalApi::experimental_reason(&self.#index)
+                        {
+                            return Some(reason);
+                        }
+                    });
                 }
             }
             (checks, experimental_fields, registrations)
@@ -175,12 +193,30 @@ fn derive_for_enum(input: &DeriveInput, data: &DataEnum) -> TokenStream {
 }
 
 fn experimental_reason(attrs: &[Attribute]) -> Option<LitStr> {
-    let attr = attrs
-        .iter()
-        .find(|attr| attr.path().is_ident("experimental"))?;
+    attrs.iter().find_map(experimental_reason_attr)
+}
+
+fn experimental_reason_attr(attr: &Attribute) -> Option<LitStr> {
+    if !attr.path().is_ident("experimental") {
+        return None;
+    }
+
     attr.parse_args::<LitStr>().ok()
 }
 
+fn has_nested_experimental(field: &Field) -> bool {
+    field.attrs.iter().any(experimental_nested_attr)
+}
+
+fn experimental_nested_attr(attr: &Attribute) -> bool {
+    if !attr.path().is_ident("experimental") {
+        return false;
+    }
+
+    attr.parse_args::<Ident>()
+        .is_ok_and(|ident| ident == "nested")
+}
+
 fn field_serialized_name(field: &Field) -> Option<String> {
     let ident = field.ident.as_ref()?;
     let name = ident.to_string();