Propagate deferred environment capability roots to MCP (#33427)

## What changed

- Let deferred environments provide selected capability roots with their ready signal.
- Validate that those roots have unique, non-empty IDs, belong to the registering environment, and stay within the root limit.
- Include roots from ready turn environments when resolving MCP contributions, and refresh the MCP runtime when the selected root set changes.
- Expose the exact ready root set to MCP contributors so executor plugins become available with their environment.

## Testing

- Cover ready-root propagation, validation failures, replacement isolation, reconnection, and MCP plugin availability refresh.

GitOrigin-RevId: ec3498aab1164824025094e96a9b1063b7b731ad

codex-rs/core/src/thread_manager_tests.rs

@@ -668,7 +668,7 @@ async fn start_thread_seeds_extension_data_for_mcp_and_lifecycle_contributors()
             &first_session.services.mcp_thread_init,
             &first_session.services.thread_extension_data,
             &first_originator,
-            /*available_environment_ids*/ &[],
+            /*ready_selected_capability_roots*/ &[],
         )
         .await;
     let second_session = &second_thread.thread.session;
@@ -681,7 +681,7 @@ async fn start_thread_seeds_extension_data_for_mcp_and_lifecycle_contributors()
             &second_session.services.mcp_thread_init,
             &second_session.services.thread_extension_data,
             &second_originator,
-            /*available_environment_ids*/ &[],
+            /*ready_selected_capability_roots*/ &[],
         )
         .await;