Allow disabling the built-in image viewer (#36966)

## What changed

- Add the stable, default-enabled `features.view_image` flag.
- Omit the native `view_image` tool when the flag is disabled, including for fresh-context subagents and guardian reviewer turns.
- Keep unrelated execution and MCP tools available when the viewer is disabled.

## Testing

- Add app-server coverage for disabled viewer inheritance in fresh-context subagents and guardian reviewer turns.

GitOrigin-RevId: 42b1311010fbde9f064129b17b425820861c6d91

codex-rs/features/src/lib.rs

@@ -87,6 +87,8 @@ pub enum Feature {
     // Stable.
     /// Enable the default shell tool.
     ShellTool,
+    /// Enable the built-in local image viewer.
+    ViewImage,
     /// Enable Claude-style lifecycle hooks loaded from hooks.json files.
     CodexHooks,
     /// Store CLI auth in the encrypted local secrets backend when keyring storage is selected.
@@ -853,6 +855,12 @@ pub const FEATURES: &[FeatureSpec] = &[
         stage: Stage::Stable,
         default_enabled: true,
     },
+    FeatureSpec {
+        id: Feature::ViewImage,
+        key: "view_image",
+        stage: Stage::Stable,
+        default_enabled: true,
+    },
     FeatureSpec {
         id: Feature::SecretAuthStorage,
         key: "secret_auth_storage",