Enforce environment MCP policies (#39335)

## What changed

- Add environment-provided MCP restrictions for configured and plugin-provided servers.
- Disable attachment-scoped servers while their environment configuration is pending, failed, or unselected, while preserving selected-plugin access and the controller-owned Apps server.
- Apply the resolved policy to runtime startup, model tool exposure, telemetry, OAuth flows, and skill dependency installation.

## Testing

- Cover policy filtering for configured and plugin servers, environment state transitions, Apps ownership, and managed OAuth rejection.

GitOrigin-RevId: 7ca5d4dda14068e758497f88835d5cba685e159e

codex-rs/core/src/thread_manager_tests.rs

@@ -3,6 +3,7 @@ use crate::agent::control::SpawnAgentOptions;
 use crate::config::test_config;
 use crate::init_state_db;
 use crate::installation_id::INSTALLATION_ID_FILENAME;
+use crate::mcp::McpEnvironmentScope;
 use crate::mcp::McpThreadIdentity;
 use crate::rollout::RolloutRecorder;
 use crate::session::session::SessionSettingsUpdate;
@@ -1031,6 +1032,7 @@ async fn start_thread_seeds_extension_data_for_mcp_and_lifecycle_contributors()
             McpThreadIdentity {
                 session_source: &SessionSource::Exec,
                 originator: &first_originator,
+                environments: McpEnvironmentScope::Live(&first_session.services.turn_environments),
             },
             /*ready_selected_capability_roots*/ &[],
             /*executor_capability_discovery*/ None,
@@ -1048,6 +1050,7 @@ async fn start_thread_seeds_extension_data_for_mcp_and_lifecycle_contributors()
             McpThreadIdentity {
                 session_source: &second_session_source,
                 originator: &second_originator,
+                environments: McpEnvironmentScope::Live(&second_session.services.turn_environments),
             },
             /*ready_selected_capability_roots*/ &[],
             /*executor_capability_discovery*/ None,