Add process-scoped PSP routing for ChatGPT requests (#36986)

## What changed

- Add a hidden global `--psp` runtime flag and propagate it through TUI, exec,
  app-server, remote-control, and in-process startup paths.
- Attach the `oai-chat-psp=true` cookie to first-party ChatGPT requests when
  enabled, using a cached cookie-aware client with sensitive request logging
  disabled.
- Keep the routing selection out of persistent configuration layers while
  preserving it across config refreshes and agent role changes.

## Testing

- Cover global flag parsing, app-server propagation, config-layer isolation,
  and preservation across config rebuilds and role changes.

GitOrigin-RevId: 05cdc61ffd7162d8e48fc1e166f4732113e5a816

codex-rs/app-server/src/main_tests.rs

@@ -46,6 +46,7 @@ fn app_server_accepts_process_scoped_code_mode_host() {
         "wss://example.test/code-mode",
         "--listen",
         "off",
+        "--psp",
     ])
     .expect("parse app-server args");
 
@@ -54,6 +55,7 @@ fn app_server_accepts_process_scoped_code_mode_host() {
         Some(Url::parse("wss://example.test/code-mode").expect("test endpoint should parse"))
     );
     assert_eq!(args.listen, AppServerTransport::Off);
+    assert!(args.psp);
     assert_eq!(args.config_overrides.raw_overrides, Vec::<String>::new());
 }