Support durable reasoning configuration updates (#42328)

## Why

Reasoning configuration changes need to retain their position and trusted provenance when model history is persisted and replayed. Client-injected history must not be able to forge these controls.

## What changed

- Add a typed `configuration_update` response item carrying reasoning effort, including custom model-defined values.
- Persist harness-authored updates with provenance and preserve them across history reconstruction, thread resume, raw response notifications, and agent forks.
- Exclude untrusted configuration updates from model history, strip client-supplied provenance metadata, and reject configuration updates supplied as turn input.
- Export the new item through the JSON and TypeScript app-server schemas and classify it in telemetry and persistence metrics.

## Testing

- Cover serialization, provenance persistence, history filtering and rollback, resume reconstruction, and injection attempts before and after restart.

GitOrigin-RevId: eb5559d2b52b7a931621e7c9812f009ff9fb8939

codex-rs/rollout/src/persistence_metrics.rs

@@ -300,6 +300,7 @@ fn response_item_type(item: &ResponseItemEnvelope) -> &'static str {
         ResponseItem::WebSearchCall { .. } => "response.web_search_call",
         ResponseItem::ImageGenerationCall { .. } => "response.image_generation_call",
         ResponseItem::Compaction { .. } => "response.compaction",
+        ResponseItem::ConfigurationUpdate { .. } => "response.configuration_update",
         ResponseItem::CompactionTrigger { .. } => "response.compaction_trigger",
         ResponseItem::ContextCompaction { .. } => "response.context_compaction",
         ResponseItem::Other => "response.other",

codex-rs/rollout/src/policy.rs

@@ -55,6 +55,7 @@ pub fn should_persist_response_item(item: &ResponseItem) -> bool {
         | ResponseItem::CustomToolCallOutput { .. }
         | ResponseItem::WebSearchCall { .. }
         | ResponseItem::ImageGenerationCall { .. }
+        | ResponseItem::ConfigurationUpdate { .. }
         | ResponseItem::Compaction { .. }
         | ResponseItem::ContextCompaction { .. } => true,
         ResponseItem::AdditionalTools { .. }
@@ -79,6 +80,7 @@ pub fn should_persist_response_item_for_memories(item: &ResponseItem) -> bool {
         | ResponseItem::WebSearchCall { .. } => true,
         ResponseItem::AdditionalTools { .. }
         | ResponseItem::Reasoning { .. }
+        | ResponseItem::ConfigurationUpdate { .. }
         | ResponseItem::ImageGenerationCall { .. }
         | ResponseItem::Compaction { .. }
         | ResponseItem::CompactionTrigger { .. }