perf(config): defer remote sandbox hostname lookup (#28542)

## Why

[#18763](https://github.com/openai/codex/pull/18763) added canonical
hostname resolution for `remote_sandbox_config`. Requirements
composition currently performs that synchronous DNS lookup on every
fresh process, even when none of the loaded requirements layers contains
`[[remote_sandbox_config]]`. On hosts with slow local DNS resolution,
this can add several seconds to Codex startup.

## What

- defer hostname resolution until a parsed requirements layer actually
contains `remote_sandbox_config`
- cache the resolver result once per requirements composition,
preserving the existing single-lookup behavior across multiple layers
- keep the existing FQDN resolution and per-layer requirements
precedence unchanged
- cover both the ordinary no-lookup path and the multi-layer
single-lookup path

## How to Test

On a host where local canonical-name resolution is slow:

1. Start Codex without `[[remote_sandbox_config]]` in any managed
requirements layer and confirm startup no longer waits for hostname
resolution.
2. Add a matching `[[remote_sandbox_config]]` entry and confirm its
`allowed_sandbox_modes` still overrides the layer's top-level value.
3. Add remote sandbox entries to multiple requirements layers and
confirm precedence remains unchanged while the hostname is resolved only
once.

Targeted tests:

- `just test -p codex-config hostname_resolver`
- `just test -p codex-config` (181 passed)

codex-rs/config/src/requirements_layers/stack.rs

@@ -18,6 +18,7 @@ use crate::ConfigRequirementsWithSources;
 use crate::RequirementSource;
 use crate::Sourced;
 use crate::merge::merge_toml_values;
+use std::cell::OnceCell;
 use std::io;
 use thiserror::Error;
 use toml::Value as TomlValue;
@@ -57,29 +58,59 @@ impl From<RequirementsCompositionError> for io::Error {
 pub fn compose_requirements(
     layers: impl IntoIterator<Item = RequirementsLayerEntry>,
 ) -> Result<Option<ConfigRequirementsWithSources>, RequirementsCompositionError> {
-    let hostname = crate::host_name();
-    compose_requirements_for_hostname(layers, hostname.as_deref())
+    compose_requirements_with_hostname_resolver(layers, crate::host_name)
 }
 
+#[cfg(test)]
 pub(super) fn compose_requirements_for_hostname(
     layers: impl IntoIterator<Item = RequirementsLayerEntry>,
     hostname: Option<&str>,
 ) -> Result<Option<ConfigRequirementsWithSources>, RequirementsCompositionError> {
-    compose_requirements_for_hostname_and_hook_directory(
+    let hostname = hostname.map(str::to_string);
+    compose_requirements_with_hostname_resolver_and_hook_directory(
         layers,
-        hostname,
+        move || hostname.clone(),
         HookDirectoryField::current_platform(),
     )
 }
 
+#[cfg(test)]
 pub(super) fn compose_requirements_for_hostname_and_hook_directory(
     layers: impl IntoIterator<Item = RequirementsLayerEntry>,
     hostname: Option<&str>,
     hook_directory_field: HookDirectoryField,
 ) -> Result<Option<ConfigRequirementsWithSources>, RequirementsCompositionError> {
+    let hostname = hostname.map(str::to_string);
+    compose_requirements_with_hostname_resolver_and_hook_directory(
+        layers,
+        move || hostname.clone(),
+        hook_directory_field,
+    )
+}
+
+fn compose_requirements_with_hostname_resolver(
+    layers: impl IntoIterator<Item = RequirementsLayerEntry>,
+    hostname_resolver: impl Fn() -> Option<String>,
+) -> Result<Option<ConfigRequirementsWithSources>, RequirementsCompositionError> {
+    compose_requirements_with_hostname_resolver_and_hook_directory(
+        layers,
+        hostname_resolver,
+        HookDirectoryField::current_platform(),
+    )
+}
+
+fn compose_requirements_with_hostname_resolver_and_hook_directory(
+    layers: impl IntoIterator<Item = RequirementsLayerEntry>,
+    hostname_resolver: impl Fn() -> Option<String>,
+    hook_directory_field: HookDirectoryField,
+) -> Result<Option<ConfigRequirementsWithSources>, RequirementsCompositionError> {
+    // Evaluate every layer in this composition against the same hostname while
+    // keeping resolution lazy when no layer needs remote sandbox matching.
+    let hostname = OnceCell::new();
+    let cached_hostname_resolver = || hostname.get_or_init(&hostname_resolver).clone();
     let mut stack = RequirementsLayerStack::new(hook_directory_field);
     for layer in layers {
-        stack.add_layer(layer, hostname)?;
+        stack.add_layer(layer, &cached_hostname_resolver)?;
     }
     stack.compose()
 }
@@ -100,10 +131,12 @@ impl RequirementsLayerStack {
     fn add_layer(
         &mut self,
         layer: RequirementsLayerEntry,
-        hostname: Option<&str>,
+        hostname_resolver: &dyn Fn() -> Option<String>,
     ) -> Result<(), RequirementsCompositionError> {
-        self.layers
-            .push(ComposableRequirementsLayer::from_entry(layer, hostname)?);
+        self.layers.push(ComposableRequirementsLayer::from_entry(
+            layer,
+            hostname_resolver,
+        )?);
         Ok(())
     }