Use snapshot session sources for MCP projection (#40368)

## What changed

Pass the session source associated with each MCP configuration snapshot into
selected-environment server projection. This keeps Guardian reviewer isolation
decisions aligned with the snapshot being projected instead of rereading the
session's mutable configuration.

GitOrigin-RevId: 61fd891fec13f62cfea9886d13e2f94f6f60922f

codex-rs/core/src/session/mcp.rs

@@ -137,7 +137,12 @@ impl Session {
             )
             .await;
         let mcp_config = self
-            .project_selected_environment_mcp_servers(config, &environments, mcp_projection)
+            .project_selected_environment_mcp_servers(
+                &session_source,
+                config,
+                &environments,
+                mcp_projection,
+            )
             .await
             .config;
         let local_process_cwd = environments
@@ -281,6 +286,7 @@ impl Session {
             .await;
         let mcp_projection = self
             .project_selected_environment_mcp_servers(
+                &desired.session_source,
                 &desired.config,
                 &desired.environments,
                 mcp_projection,

codex-rs/core/src/session/mcp_runtime.rs

@@ -144,14 +144,13 @@ impl Session {
     /// Adds effective executor-owned configuration from this exact thread snapshot.
     pub(super) fn project_selected_environment_mcp_servers<'a>(
         &'a self,
+        session_source: &'a SessionSource,
         config: &'a Config,
         environments: &'a TurnEnvironmentSnapshot,
         mut projection: McpRuntimeProjection,
     ) -> BoxFuture<'a, McpRuntimeProjection> {
         Box::pin(async move {
-            if crate::guardian::is_guardian_reviewer_source(
+            if crate::guardian::is_guardian_reviewer_source(session_source) {
-                &self.state.lock().await.session_configuration.session_source,
-            ) {
                 return projection;
             }
 
@@ -286,6 +285,7 @@ impl Session {
     ) {
         let mcp_projection = self
             .project_selected_environment_mcp_servers(
+                &desired.session_source,
                 &desired.config,
                 &desired.environments,
                 mcp_projection,