Expose MCP read-only hints in tool call items (#36055)

## What changed

- Propagate MCP tool `readOnlyHint` annotations through tool-call start and
  completion events.
- Include the optional hint in persisted thread history and app-server
  `mcpToolCall` items, preserving compatibility when the annotation is absent.
- Document that the hint describes tool capability, not the outcome of a
  particular invocation.

## Testing

- Cover read-only and write-capable tools in live events and persisted rollout
  data.
- Verify the hint survives thread reads and resumes for both in-progress and
  completed MCP calls.

GitOrigin-RevId: dddfe905146075e5137a1094da485b86b99807f0

codex-rs/tui/src/chatwidget/tests/history_replay.rs

@@ -1171,6 +1171,7 @@ async fn replayed_in_progress_mcp_tool_call_stays_active() {
             app_context: None,
             mcp_app_resource_uri: None,
             plugin_id: None,
+            read_only_hint: None,
             result: None,
             error: None,
             duration_ms: None,
@@ -1204,6 +1205,7 @@ async fn deferred_mcp_lifecycle_events_keep_fifo_after_stream_finishes() {
         app_context: None,
         mcp_app_resource_uri: None,
         plugin_id: None,
+        read_only_hint: None,
         result: None,
         error: None,
         duration_ms: None,
@@ -1220,6 +1222,7 @@ async fn deferred_mcp_lifecycle_events_keep_fifo_after_stream_finishes() {
         app_context: None,
         mcp_app_resource_uri: None,
         plugin_id: None,
+        read_only_hint: None,
         result: Some(Box::new(codex_app_server_protocol::McpToolCallResult {
             content: vec![json!({"type": "text", "text": "deferred result"})],
             structured_content: None,