Add an API for reading installed app runtime state (#33843)

## What changed

- Add `app/installed` to return each connector observed in the committed runtime tool snapshot, including its runtime name and effective `enabled` and `callable` state.
- Support evaluating thread-specific configuration with `threadId` and refreshing the hosted connector tool snapshot with `forceRefresh`.
- Preserve observed connector identities as disabled when global or workspace policy disables Apps, and retain the previous snapshot when a refresh fails.

## Testing

- Cover cached and forced reads, policy and configuration filtering, thread-specific configuration, snapshot refresh failures, and protocol serialization.

GitOrigin-RevId: f697b6fb501b7d329a169e947a1c1607806222fe

codex-rs/app-server-protocol/src/protocol/v2/apps.rs

@@ -24,6 +24,45 @@ pub struct AppsListParams {
     pub force_refetch: bool,
 }
 
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Default, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+/// Read the committed installed connector runtime snapshot.
+pub struct AppsInstalledParams {
+    /// Optional loaded thread id used to evaluate effective app configuration.
+    #[ts(optional = nullable)]
+    pub thread_id: Option<String>,
+    /// When true and Apps are permitted, refresh and publish the hosted connector runtime tool
+    /// snapshot first.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub force_refresh: bool,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+/// Installed connector runtime state.
+pub struct InstalledApp {
+    pub id: String,
+    /// Best-effort name carried by the runtime tool catalog. Canonical app metadata remains owned
+    /// by `app/read`.
+    pub runtime_name: Option<String>,
+    /// Effective enabled state after applying global, workspace, local, and managed configuration
+    /// at read time.
+    pub enabled: bool,
+    /// Whether the connector is enabled and has a non-synthetic, model-visible tool allowed by
+    /// effective MCP and app/tool policy in the committed runtime snapshot.
+    pub callable: bool,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+/// The installed connectors in one committed runtime snapshot.
+pub struct AppsInstalledResponse {
+    pub apps: Vec<InstalledApp>,
+}
+
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)]
 #[serde(rename_all = "camelCase")]
 #[ts(export_to = "v2/")]