[codex] reduce module visibility (#16978)

## Summary
- reduce public module visibility across Rust crates, preferring private
or crate-private modules with explicit crate-root public exports
- update external call sites and tests to use the intended public crate
APIs instead of reaching through module trees
- add the module visibility guideline to AGENTS.md

## Validation
- `cargo check --workspace --all-targets --message-format=short` passed
before the final fix/format pass
- `just fix` completed successfully
- `just fmt` completed successfully
- `git diff --check` passed

codex-rs/core/src/tools/runtimes/mod.rs

@@ -12,9 +12,9 @@ use codex_sandboxing::SandboxCommand;
 use std::collections::HashMap;
 use std::path::Path;
 
-pub mod apply_patch;
-pub mod shell;
-pub mod unified_exec;
+pub(crate) mod apply_patch;
+pub(crate) mod shell;
+pub(crate) mod unified_exec;
 
 /// Shared helper to construct sandbox transform inputs from a tokenized command line.
 /// Validates that at least a program is present.