[mcp] Expand tool search to custom MCPs. (#16944)

- [x] Expand tool search to custom MCPs.
- [x] Rename several variables/fields to be more generic.

Updated tool & server name lifecycles:

**Raw Identity**

ToolInfo.server_name is raw MCP server name.
ToolInfo.tool.name is raw MCP tool name.
MCP calls route back to raw via parse_tool_name() returning
(tool.server_name, tool.tool.name).
mcpServerStatus/list now groups by raw server and keys tools by
Tool.name: mod.rs:599
App-server just forwards that grouped raw snapshot:
codex_message_processor.rs:5245

**Callable Names**

On list-tools, we create provisional callable_namespace / callable_name:
mcp_connection_manager.rs:1556
For non-app MCP, provisional callable name starts as raw tool name.
For codex-apps, provisional callable name is sanitized and strips
connector name/id prefix; namespace includes connector name.
Then qualify_tools() sanitizes callable namespace + name to ASCII alnum
/ _ only: mcp_tool_names.rs:128
Note: this is stricter than Responses API. Hyphen is currently replaced
with _ for code-mode compatibility.

**Collision Handling**

We do initially collapse example-server and example_server to the same
base.
Then qualify_tools() detects distinct raw namespace identities behind
the same sanitized namespace and appends a hash to the callable
namespace: mcp_tool_names.rs:137
Same idea for tool-name collisions: hash suffix goes on callable tool
name.
Final list_all_tools() map key is callable_namespace + callable_name:
mcp_connection_manager.rs:769

**Direct Model Tools**

Direct MCP tool declarations use the full qualified sanitized key as the
Responses function name.
The raw rmcp Tool is converted but renamed for model exposure.

**Tool Search / Deferred**

Tool search result namespace = final ToolInfo.callable_namespace:
tool_search.rs:85
Tool search result nested name = final ToolInfo.callable_name:
tool_search.rs:86
Deferred tool handler is registered as "{namespace}:{name}":
tool_registry_plan.rs:248
When a function call comes back, core recombines namespace + name, looks
up the full qualified key, and gets the raw server/tool for MCP
execution: codex.rs:4353

**Separate Legacy Snapshot**

collect_mcp_snapshot_from_manager_with_detail() still returns a map
keyed by qualified callable name.
mcpServerStatus/list no longer uses that; it uses
McpServerStatusSnapshot, which is raw-inventory shaped.

codex-rs/core/src/mcp_tool_exposure.rs

@@ -0,0 +1,73 @@
+use std::collections::HashMap;
+use std::collections::HashSet;
+
+use codex_mcp::CODEX_APPS_MCP_SERVER_NAME;
+use codex_mcp::ToolInfo as McpToolInfo;
+use codex_mcp::filter_non_codex_apps_mcp_tools_only;
+use codex_tools::ToolsConfig;
+
+use crate::config::Config;
+use crate::connectors;
+
+pub(crate) const DIRECT_MCP_TOOL_EXPOSURE_THRESHOLD: usize = 100;
+
+pub(crate) struct McpToolExposure {
+    pub(crate) direct_tools: HashMap<String, McpToolInfo>,
+    pub(crate) deferred_tools: Option<HashMap<String, McpToolInfo>>,
+}
+
+pub(crate) fn build_mcp_tool_exposure(
+    all_mcp_tools: &HashMap<String, McpToolInfo>,
+    connectors: Option<&[connectors::AppInfo]>,
+    explicitly_enabled_connectors: &[connectors::AppInfo],
+    config: &Config,
+    tools_config: &ToolsConfig,
+) -> McpToolExposure {
+    let mut deferred_tools = filter_non_codex_apps_mcp_tools_only(all_mcp_tools);
+    if let Some(connectors) = connectors {
+        deferred_tools.extend(filter_codex_apps_mcp_tools(
+            all_mcp_tools,
+            connectors,
+            config,
+        ));
+    }
+
+    if !tools_config.search_tool || deferred_tools.len() < DIRECT_MCP_TOOL_EXPOSURE_THRESHOLD {
+        return McpToolExposure {
+            direct_tools: deferred_tools,
+            deferred_tools: None,
+        };
+    }
+
+    let direct_tools =
+        filter_codex_apps_mcp_tools(all_mcp_tools, explicitly_enabled_connectors, config);
+    McpToolExposure {
+        direct_tools,
+        deferred_tools: Some(deferred_tools),
+    }
+}
+
+fn filter_codex_apps_mcp_tools(
+    mcp_tools: &HashMap<String, McpToolInfo>,
+    connectors: &[connectors::AppInfo],
+    config: &Config,
+) -> HashMap<String, McpToolInfo> {
+    let allowed: HashSet<&str> = connectors
+        .iter()
+        .map(|connector| connector.id.as_str())
+        .collect();
+
+    mcp_tools
+        .iter()
+        .filter(|(_, tool)| {
+            if tool.server_name != CODEX_APPS_MCP_SERVER_NAME {
+                return false;
+            }
+            let Some(connector_id) = tool.connector_id.as_deref() else {
+                return false;
+            };
+            allowed.contains(connector_id) && connectors::codex_app_tool_is_enabled(config, tool)
+        })
+        .map(|(name, tool)| (name.clone(), tool.clone()))
+        .collect()
+}