Add a managed gate for in-app local automation (#40436)

## What changed

- Register the stable, requirements-only `in_app_local_automation` feature for desktop apps.
- Add the feature to the configuration schema.
- Verify that an enterprise requirement can disable local automation.

GitOrigin-RevId: 939f7f3ee15f662dc85589cd1bcc3838e4cd1287

codex-rs/core/src/config/config_tests.rs

@@ -11160,6 +11160,28 @@ in_app_dictation = false
     Ok(())
 }
 
+#[tokio::test]
+async fn in_app_local_automation_feature_requirements_are_valid() -> std::io::Result<()> {
+    let codex_home = TempDir::new()?;
+
+    let config = ConfigBuilder::without_managed_config_for_tests()
+        .codex_home(codex_home.path().to_path_buf())
+        .cloud_config_bundle(
+            CloudConfigBundleFixture::loader_with_enterprise_requirement(
+                r#"
+[features]
+in_app_local_automation = false
+"#,
+            ),
+        )
+        .build()
+        .await?;
+
+    assert!(!config.features.enabled(Feature::InAppLocalAutomation));
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn explicit_feature_config_is_normalized_by_requirements() -> std::io::Result<()> {
     let codex_home = TempDir::new()?;