Embed defaults in the packaged config layer (#38179)

## What changed

- Add an embedded `defaults.toml` and always install it as the lowest-precedence configuration layer when no packaged-defaults path is supplied.
- Keep packaged defaults out of config RPC layer and origin metadata.
- Report a user setting as overridden only when the effective layer has higher precedence, so clearing a setting can fall back to its packaged default without a false override.

## Testing

- Cover loading the packaged layer when other configuration files are absent.
- Cover config RPC filtering and clearing a user value that falls back to a packaged default.

GitOrigin-RevId: c1c0e1e681e4ac1be2602550972533443c5df51b

codex-rs/config/defaults.toml

@@ -0,0 +1,17 @@
+# Fixed defaults for packaged Codex clients.
+include_permissions_instructions = true
+include_apps_instructions = true
+include_collaboration_mode_instructions = true
+include_environment_context = true
+cli_auth_credentials_store = "file"
+mcp_oauth_credentials_store = "auto"
+project_doc_max_bytes = 32768
+project_doc_fallback_filenames = []
+background_terminal_max_timeout = 300000
+file_opener = "vscode"
+hide_agent_reasoning = false
+chatgpt_base_url = "https://chatgpt.com/backend-api/"
+project_root_markers = [".git"]
+
+[history]
+persistence = "save-all"