feat: make built-in MCPs first-class runtime servers (#21356)

## DISCLAIMER
This is experimental and no production service must rely on this

## Why

Built-in MCPs are product-owned runtime capabilities, but they were
previously flattened into the same config-backed stdio path as
user-configured servers. That made them depend on a hidden `codex
builtin-mcp` re-exec path, exposed them through config-oriented CLI
flows, and erased distinctions the runtime needs to preserve—most
notably whether an MCP call should count as external context for
memory-mode pollution.

## What changed

- Model product-owned built-ins separately from config-backed MCP
servers via `BuiltinMcpServer` and `EffectiveMcpServer`.
- Launch built-ins in process through a reusable async transport instead
of the hidden `builtin-mcp` stdio subcommand.
- Keep config-oriented CLI operations such as `codex mcp
list/get/login/logout` scoped to configured servers, while merging
built-ins only into the effective runtime server set.
- Retain server metadata after launch so parallel-tool support and
context classification come from the live server set; built-in
`memories` is now classified as local Codex state rather than external
context.

## Test plan

- `cargo test -p codex-mcp`
- `cargo test -p codex-core --test suite
builtin_memories_mcp_call_does_not_mark_thread_memory_mode_polluted_when_configured`

---------

Co-authored-by: Codex <noreply@openai.com>

codex-rs/codex-mcp/src/lib.rs

@@ -10,6 +10,7 @@ pub use tools::ToolInfo;
 pub use mcp::CODEX_APPS_MCP_SERVER_NAME;
 pub use mcp::McpConfig;
 pub use mcp::ToolPluginProvenance;
+pub use server::EffectiveMcpServer;
 
 pub use auth_elicitation::CodexAppsAuthElicitation;
 pub use auth_elicitation::CodexAppsAuthElicitationPlan;
@@ -22,12 +23,14 @@ pub use auth_elicitation::build_auth_elicitation_plan;
 pub use auth_elicitation::connector_auth_failure_from_tool_result;
 pub use codex_apps::CodexAppsToolsCacheKey;
 pub use codex_apps::codex_apps_tools_cache_key;
+pub use codex_builtin_mcps::BuiltinMcpServer;
 pub use codex_builtin_mcps::BuiltinMcpServerOptions;
 pub use codex_builtin_mcps::MEMORIES_MCP_SERVER_NAME;
-pub use codex_builtin_mcps::configured_builtin_mcp_servers;
+pub use codex_builtin_mcps::enabled_builtin_mcp_servers;
 
 pub use mcp::configured_mcp_servers;
 pub use mcp::effective_mcp_servers;
+pub use mcp::effective_mcp_servers_from_configured;
 pub use mcp::host_owned_codex_apps_enabled;
 pub use mcp::tool_plugin_provenance;
 pub use mcp::with_codex_apps_mcp;
@@ -55,10 +58,12 @@ pub use mcp::qualified_mcp_tool_name_prefix;
 pub use tools::declared_openai_file_input_param_names;
 
 pub(crate) mod auth_elicitation;
+pub(crate) mod builtin;
 pub(crate) mod codex_apps;
 pub(crate) mod connection_manager;
 pub(crate) mod elicitation;
 pub(crate) mod mcp;
 pub(crate) mod rmcp_client;
 pub(crate) mod runtime;
+pub(crate) mod server;
 pub(crate) mod tools;