[codex] reduce module visibility (#16978)

## Summary
- reduce public module visibility across Rust crates, preferring private
or crate-private modules with explicit crate-root public exports
- update external call sites and tests to use the intended public crate
APIs instead of reaching through module trees
- add the module visibility guideline to AGENTS.md

## Validation
- `cargo check --workspace --all-targets --message-format=short` passed
before the final fix/format pass
- `just fix` completed successfully
- `just fmt` completed successfully
- `git diff --check` passed

codex-rs/core/src/state_db_bridge.rs

@@ -1,18 +1,5 @@
 use codex_rollout::state_db as rollout_state_db;
 pub use codex_rollout::state_db::StateDbHandle;
-pub use codex_rollout::state_db::apply_rollout_items;
-pub use codex_rollout::state_db::find_rollout_path_by_id;
-pub use codex_rollout::state_db::get_dynamic_tools;
-pub use codex_rollout::state_db::list_thread_ids_db;
-pub use codex_rollout::state_db::list_threads_db;
-pub use codex_rollout::state_db::mark_thread_memory_mode_polluted;
-pub use codex_rollout::state_db::normalize_cwd_for_state_db;
-pub use codex_rollout::state_db::open_if_present;
-pub use codex_rollout::state_db::persist_dynamic_tools;
-pub use codex_rollout::state_db::read_repair_rollout_path;
-pub use codex_rollout::state_db::reconcile_rollout;
-pub use codex_rollout::state_db::touch_thread_updated_at;
-pub use codex_state::LogEntry;
 
 use crate::config::Config;