Expose thread originators through the app-server API (#42458)

## What changed

- Add the creation-time `originator` to app-server thread responses and `thread/started` notifications.
- Persist originators in thread metadata and preserve the first recorded value across list, read, resume, rollout, and SQLite paths.
- Add an `originators` allowlist to `thread/list` for hosted backends. The local app-server accepts omitted or empty values but rejects nonempty filters.

## Testing

- Cover originator persistence across server restarts and list, read, and resume requests.
- Verify local `thread/list` handling for nonempty, omitted, null, and empty originator filters.
- Heap-allocate large TUI dispatcher futures in affected tests to keep them within the Windows test-thread stack.

GitOrigin-RevId: 73ad6e61b8fdd2d93a22d1f971723a19ec7be3fc

codex-rs/exec/src/lib_tests.rs

@@ -373,6 +373,7 @@ fn turn_items_for_thread_returns_matching_turn_items() {
         path: None,
         cwd: test_path_buf("/tmp/project").abs(),
         cli_version: "0.0.0-test".to_string(),
+        originator: None,
         source: codex_app_server_protocol::SessionSource::Exec,
         can_accept_direct_input: None,
         thread_source: None,
@@ -842,6 +843,7 @@ async fn session_configured_from_thread_response_preserves_parent_thread_id() {
 fn sample_thread_start_response() -> ThreadStartResponse {
     ThreadStartResponse {
         thread: codex_app_server_protocol::Thread {
+            originator: None,
             environments: None,
             id: "67e55044-10b1-426f-9247-bb680e5fe0c8".to_string(),
             extra: None,