Support packaged defaults in config layering (#37810)

## What changed

- Load an optional package-supplied config file as the lowest-precedence
  configuration layer, so every existing layer can override its values.
- Report the layer as `packagedDefaults`, including its source path, through
  config diagnostics and the app-server protocol.
- Return an error when a configured packaged defaults file is missing.

## Testing

- Cover precedence across packaged, system, user, and session layers.
- Cover the missing-file error path.

GitOrigin-RevId: 52406890f4d580eedabc90bf2a9ee3affa36fee1

codex-rs/app-server/src/config_layer.rs

@@ -13,6 +13,9 @@ use codex_config::ConfigLayerSource;
 /// function instead of a `From` implementation.
 pub(crate) fn config_layer_source_to_api(source: ConfigLayerSource) -> ApiConfigLayerSource {
     match source {
+        ConfigLayerSource::PackagedDefaults { file } => {
+            ApiConfigLayerSource::PackagedDefaults { file }
+        }
         ConfigLayerSource::Mdm { domain, key } => ApiConfigLayerSource::Mdm { domain, key },
         ConfigLayerSource::System { file } => ApiConfigLayerSource::System { file },
         ConfigLayerSource::EnterpriseManaged { id, name } => {

codex-rs/app-server/src/config_manager_service.rs

@@ -781,6 +781,9 @@ fn value_at_semantic_path<'a>(root: &'a TomlValue, segments: &[String]) -> Optio
 
 fn override_message(layer: &ConfigLayerSource) -> String {
     match layer {
+        ConfigLayerSource::PackagedDefaults { file } => {
+            format!("Overridden by packaged defaults: {}", file.display())
+        }
         ConfigLayerSource::Mdm { domain, key: _ } => {
             format!("Overridden by managed policy (MDM): {domain}")
         }