Enforce Agent Plugin runtime boundaries (#37027)

## What changed

- Track Agent Plugin manifests through plugin, skill, and MCP loading so their capabilities use format-specific behavior without changing legacy plugins.
- Discover only direct-child skills, exclude app and hook capabilities, isolate MCP data, and reject MCP configuration files that are non-regular or resolve outside the plugin root.
- Bound model-visible skill instructions, plugin instructions, MCP descriptions, schemas, individual tools, and the aggregate Agent Plugin MCP tool set.
- Stop MCP and OAuth redirects when Agent Plugins send configured or authorization headers, while retaining existing redirect behavior for legacy MCP servers.

## Testing

- Add coverage for capability filtering, skill discovery, isolated MCP data and reserved-path expansion, unsafe MCP configuration files, context limits, and redirect handling.

GitOrigin-RevId: c9af66b051269f3226628ca280a58d32c808c38f

codex-rs/tools/src/mcp_tool_tests.rs

@@ -1,4 +1,5 @@
 use super::mcp_call_tool_result_output_schema;
+use super::parse_agent_plugin_mcp_tool;
 use super::parse_mcp_tool;
 use crate::JsonSchema;
 use crate::ToolDefinition;
@@ -39,6 +40,40 @@ fn parse_mcp_tool_inserts_empty_properties() {
     );
 }
 
+#[test]
+fn agent_plugin_mcp_tool_bounds_model_visible_description() {
+    let description = format!("{}é", "a".repeat(super::MAX_MCP_TOOL_DESCRIPTION_BYTES - 1));
+    let tool = mcp_tool(
+        "bounded_description",
+        &description,
+        serde_json::json!({"type": "object"}),
+    );
+
+    let parsed = parse_agent_plugin_mcp_tool(&tool).expect("parse Agent Plugin MCP tool");
+
+    assert_eq!(
+        parsed.description.len(),
+        super::MAX_MCP_TOOL_DESCRIPTION_BYTES - 1
+    );
+}
+
+#[test]
+fn legacy_mcp_tool_preserves_long_description() {
+    let description = "a".repeat(super::MAX_MCP_TOOL_DESCRIPTION_BYTES + 100);
+    let tool = mcp_tool(
+        "legacy_description",
+        &description,
+        serde_json::json!({"type": "object"}),
+    );
+
+    assert_eq!(
+        parse_mcp_tool(&tool)
+            .expect("parse legacy MCP tool")
+            .description,
+        description
+    );
+}
+
 #[test]
 fn parse_mcp_tool_preserves_top_level_output_schema() {
     let mut tool = mcp_tool(