Register the untrusted_as_tool_output feature flag (#57204)

## What changed

Add `untrusted_as_tool_output` as an under-development feature, disabled by default, and expose it in the configuration schema. The flag is intended for rendering client-supplied untrusted context as standalone named tool outputs.

GitOrigin-RevId: 6fe630c8d380a87edb48e08887215c1ec17447ed

codex-rs/core/config.schema.json

@@ -1395,6 +1395,9 @@
             "unified_image_budget": {
               "type": "boolean"
             },
+            "untrusted_as_tool_output": {
+              "type": "boolean"
+            },
             "use_agent_identity": {
               "type": "boolean"
             },
@@ -8000,6 +8003,9 @@
         "unified_image_budget": {
           "type": "boolean"
         },
+        "untrusted_as_tool_output": {
+          "type": "boolean"
+        },
         "use_agent_identity": {
           "type": "boolean"
         },

codex-rs/features/src/lib.rs

@@ -134,6 +134,8 @@ pub enum Feature {
     MultiEnvCopyFile,
     /// Send per-content-entry classifications in internal Responses metadata.
     ContentItemKinds,
+    /// Render client-supplied untrusted context as standalone named tool outputs.
+    UntrustedAsToolOutput,
     /// Record model-attempted tool calls in internal Responses metadata.
     ExecutedToolCallMetadata,
     /// Enable JavaScript code mode backed by the standalone host process.
@@ -1202,6 +1204,12 @@ pub const FEATURES: &[FeatureSpec] = &[
         stage: Stage::Stable,
         default_enabled: true,
     },
+    FeatureSpec {
+        id: Feature::UntrustedAsToolOutput,
+        key: "untrusted_as_tool_output",
+        stage: Stage::UnderDevelopment,
+        default_enabled: false,
+    },
     FeatureSpec {
         id: Feature::ExecutedToolCallMetadata,
         key: "executed_tool_call_metadata",