Enforce required environment skills before model inference (#51157)

## What changed

- Accept per-environment `skills.required` lists through `environment/add` and `environments.toml`.
- Before inference, require each named skill to be enabled and supplied by the selected environment. Missing skills fail the turn before a model request, including when environment setup fails.
- Stop applying an environment's requirements after it is deselected. Exempt isolated Guardian reviewers, which have no skill catalog.

## Testing

Add tests for available, missing, disabled, and wrong-environment skills, failed environment setup, recovery after deselection, and propagation of TOML requirements to the correct environment.

GitOrigin-RevId: 302ced4774697d2f414f745fe0535e71f747eda2

codex-rs/config/src/lib.rs

@@ -211,6 +211,7 @@ pub use requirements_layers::compose_requirements;
 pub use requirements_layers::compose_requirements_for_hostname;
 pub use shell_environment_policy::validate_shell_environment_policy_filter_config;
 pub use skills_config::BundledSkillsConfig;
+pub use skills_config::ScopedSkillsConfig;
 pub use skills_config::SkillConfig;
 pub use skills_config::SkillConfigRule;
 pub use skills_config::SkillConfigRuleSelector;

codex-rs/config/src/skills_config.rs

@@ -27,6 +27,14 @@ pub struct SkillConfig {
     pub enabled: bool,
 }
 
+/// Skills required from one environment or plugin before inference.
+#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema)]
+#[serde(deny_unknown_fields)]
+pub struct ScopedSkillsConfig {
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub required: Vec<String>,
+}
+
 #[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema)]
 #[schemars(deny_unknown_fields)]
 pub struct SkillsConfig {