Move requirements policy ownership to execpolicy (#38899)

## What changed

- Define and export `RequirementsExecPolicy` from `codex-execpolicy`, alongside the
  underlying `Policy` type.
- Re-export the type from `codex-config` so existing config consumers retain the
  same API.
- Preserve its order-independent equality and `AsRef<Policy>` behavior.

GitOrigin-RevId: e94c56b36824d07f2bc7ba14ce40bdb770d4ab46

codex-rs/execpolicy/src/policy.rs

@@ -31,6 +31,43 @@ pub struct Policy {
     host_executables_by_name: HashMap<String, Arc<[AbsolutePathBuf]>>,
 }
 
+/// A requirements-owned execution policy with order-independent equality.
+#[derive(Debug, Clone)]
+pub struct RequirementsExecPolicy {
+    policy: Policy,
+}
+
+impl RequirementsExecPolicy {
+    pub fn new(policy: Policy) -> Self {
+        Self { policy }
+    }
+}
+
+impl PartialEq for RequirementsExecPolicy {
+    fn eq(&self, other: &Self) -> bool {
+        policy_fingerprint(&self.policy) == policy_fingerprint(&other.policy)
+    }
+}
+
+impl Eq for RequirementsExecPolicy {}
+
+impl AsRef<Policy> for RequirementsExecPolicy {
+    fn as_ref(&self) -> &Policy {
+        &self.policy
+    }
+}
+
+fn policy_fingerprint(policy: &Policy) -> Vec<String> {
+    let mut entries = Vec::new();
+    for (program, rules) in policy.rules().iter_all() {
+        for rule in rules {
+            entries.push(format!("{program}:{rule:?}"));
+        }
+    }
+    entries.sort();
+    entries
+}
+
 impl Policy {
     pub fn new(rules_by_program: MultiMap<String, RuleRef>) -> Self {
         Self::from_parts(rules_by_program, Vec::new(), HashMap::new())