Derive report prompt hashes from persisted rollouts (#36271)

## Why

Report prompt metadata should reflect the persisted rollout instead of
unverified tags supplied by the client.

## What changed

- Hash the session's base instructions with SHA-256 after normalizing
  whitespace, and add the result to report uploads as `prompt_hash`.
- Treat `prompt_hash` and `prompt_version` as reserved tags: remove
  client-provided values and only restore `prompt_hash` when it can be derived
  from the rollout.
- Collect the prompt hash alongside the selected turn's model and reasoning
  effort metadata.

## Testing

Added unit tests for prompt normalization, rollout metadata selection, and
replacement or removal of client-provided prompt tags.

GitOrigin-RevId: 4a21d7b90e100f96f3f7b39d07fec75b30c0d33f

codex-rs/app-server/Cargo.toml

@@ -91,6 +91,7 @@ clap = { workspace = true, features = ["derive"] }
 futures = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
+sha2 = { workspace = true }
 tempfile = { workspace = true }
 thiserror = { workspace = true }
 time = { workspace = true }
@@ -135,7 +136,6 @@ rmcp = { workspace = true, default-features = false, features = [
     "transport-streamable-http-server",
 ] }
 serial_test = { workspace = true }
-sha2 = { workspace = true }
 shlex = { workspace = true }
 tar = { workspace = true }
 test-case = "3.3.1"