[codex] Prune unused codex-mcp API and duplicate helpers (#19524)

## Why

`codex-mcp` currently exposes more API than the rest of the workspace
uses. Some of that surface is simply visibility that can be tightened,
and some of it is public helper code that remains compiler-valid because
it is exported even though no workspace caller uses it.

That distinction matters: Rust does not warn on exported API just
because the current workspace does not call it. This PR intentionally
treats those exported-but-workspace-unreferenced paths as stale
`codex-mcp` surface. The main example is MCP skill dependency
collection, where the active implementation now lives in
`codex-rs/core/src/mcp_skill_dependencies.rs`; keeping the older
`codex-mcp` copy makes it unclear which implementation owns skill MCP
installation.

## What Changed

- Pruned unused `codex-mcp` re-exports from `codex-mcp/src/lib.rs`.
- Removed non-runtime helper methods from `McpConnectionManager` so it
stays focused on live MCP clients.
- Made `ToolPluginProvenance` lookup methods crate-private.
- Removed workspace-unreferenced snapshot wrapper APIs and
qualified-tool grouping helpers.
- Deleted the duplicate `codex-mcp` skill dependency module and tests
now that skill MCP dependency handling is owned by `core`.

## Verification

- `cargo check -p codex-mcp`

codex-rs/codex-mcp/src/lib.rs

@@ -5,7 +5,6 @@ pub(crate) mod mcp_tool_names;
 pub use mcp::CODEX_APPS_MCP_SERVER_NAME;
 pub use mcp::McpAuthStatusEntry;
 pub use mcp::McpConfig;
-pub use mcp::McpManager;
 pub use mcp::McpOAuthLoginConfig;
 pub use mcp::McpOAuthLoginSupport;
 pub use mcp::McpOAuthScopesSource;
@@ -13,30 +12,21 @@ pub use mcp::McpServerStatusSnapshot;
 pub use mcp::McpSnapshotDetail;
 pub use mcp::ResolvedMcpOAuthScopes;
 pub use mcp::ToolPluginProvenance;
-pub use mcp::canonical_mcp_server_key;
-pub use mcp::collect_mcp_server_status_snapshot;
 pub use mcp::collect_mcp_server_status_snapshot_with_detail;
-pub use mcp::collect_mcp_snapshot;
 pub use mcp::collect_mcp_snapshot_from_manager;
-pub use mcp::collect_mcp_snapshot_from_manager_with_detail;
-pub use mcp::collect_mcp_snapshot_with_detail;
-pub use mcp::collect_missing_mcp_dependencies;
 pub use mcp::compute_auth_statuses;
 pub use mcp::configured_mcp_servers;
 pub use mcp::discover_supported_scopes;
 pub use mcp::effective_mcp_servers;
-pub use mcp::group_tools_by_server;
 pub use mcp::mcp_permission_prompt_is_auto_approved;
 pub use mcp::oauth_login_support;
 pub use mcp::qualified_mcp_tool_name_prefix;
 pub use mcp::read_mcp_resource;
 pub use mcp::resolve_oauth_scopes;
 pub use mcp::should_retry_without_scopes;
-pub use mcp::split_qualified_tool_name;
 pub use mcp::tool_plugin_provenance;
 pub use mcp::with_codex_apps_mcp;
 pub use mcp_connection_manager::CodexAppsToolsCacheKey;
-pub use mcp_connection_manager::DEFAULT_STARTUP_TIMEOUT;
 pub use mcp_connection_manager::MCP_SANDBOX_STATE_META_CAPABILITY;
 pub use mcp_connection_manager::McpConnectionManager;
 pub use mcp_connection_manager::McpRuntimeEnvironment;