Add WebSocket transport to the code-mode host (#35078)

## What changed

- Add a `--listen` option that accepts `stdio`, `stdio://`, or a
  `ws://IP:PORT` endpoint, while retaining stdio as the default.
- Serve the existing length-prefixed protocol in binary WebSocket messages,
  with isolated connections, shared host limits, and a `/readyz` endpoint.
- Reject browser-origin handshakes and contain malformed frames to the affected
  connection.

## Testing

- Cover listen URL parsing and complete-frame encoding and decoding.
- Exercise readiness, cell execution, tool callbacks, large frames, concurrent
  connections, malformed frames, and origin rejection through the WebSocket
  listener.

GitOrigin-RevId: 01c8be4c6256b8ce4a3a0002440dcb3294e5f887

codex-rs/code-mode-host/src/main.rs

@@ -1,4 +1,23 @@
+use clap::Parser;
+
+#[derive(Debug, Parser)]
+struct Cli {
+    /// Transport endpoint: `stdio`, `stdio://`, or `ws://IP:PORT`.
+    #[arg(
+        long,
+        value_name = "URL",
+        default_value = codex_code_mode_host::DEFAULT_LISTEN_URL
+    )]
+    listen: String,
+}
+
 #[tokio::main(flavor = "current_thread")]
 async fn main() -> anyhow::Result<()> {
-    codex_code_mode_host::run_stdio().await
+    tracing_subscriber::fmt()
+        .with_max_level(tracing::Level::INFO)
+        .with_writer(std::io::stderr)
+        .with_ansi(false)
+        .init();
+
+    codex_code_mode_host::run_main(&Cli::parse().listen).await
 }