Propagate Apps tool refreshes to existing threads (#43900)

## Why

Refreshing installed Apps without a thread should update the tools available to existing threads on their next turn.

## What changed

- Publish live tool catalogs to clients with matching transport, auth, protocol, and listing settings within the same account and home directory. Ignore the thread attribution header when matching scopes.
- Adopt updated tools before catalog reads and new calls, preserving running calls and rejecting calls prepared against an outdated catalog revision.
- Keep the newest successful fetch per scope so older refreshes cannot overwrite newer tools, and exclude disk snapshots from live updates.

## Testing

Add regression coverage for refresh propagation to an existing thread without another tools listing, scope and account isolation, out-of-order refreshes, late client startup, and running versus stale prepared calls.

GitOrigin-RevId: 7a5ee34e23742ce374c6647dc8928b76ea622448

codex-rs/codex-mcp/src/binding_tests.rs

@@ -77,7 +77,10 @@ async fn test_step(
             .await
             .expect("create in-process MCP client"),
     );
-    let tool_catalog = Arc::new(ClientToolCatalog::new(vec![tool.clone()]));
+    let tool_catalog = Arc::new(ClientToolCatalog::new(
+        vec![tool.clone()],
+        /*updates*/ None,
+    ));
     let managed_client = Arc::new(ManagedClient {
         _auth_change_notifications: None,
         client: Arc::clone(&client),