Refresh managed MCP requirements for active threads (#35213)

## Why

MCP config reloads updated resolved server and authentication values, but did not
carry managed server constraints or plugin requirements into active threads.

## What changed

- Refresh MCP state from the typed thread config, including its managed
  requirements, while retaining the thread's user layer and unrelated settings.
- Apply the refreshed config directly through `CodexThread` instead of encoding it
  as a protocol operation.
- Re-evaluate effective plugins immediately after account changes so their MCP
  requirements reach existing threads.

## Testing

- Cover replacement and enforcement of managed server and plugin requirements.
- Verify refreshed MCP settings are installed without changing the active model.

GitOrigin-RevId: 3cf0d69f51ef4893a4d722ee803fcbfdf1cd959e

codex-rs/core/src/codex_thread.rs

@@ -627,6 +627,11 @@ impl CodexThread {
         self.session.refresh_runtime_config(next_config).await;
     }
 
+    /// Refresh MCP configuration and managed requirements without reloading unrelated settings.
+    pub async fn refresh_mcp_config(&self, next_config: crate::config::Config) {
+        self.session.refresh_mcp_config(next_config).await;
+    }
+
     pub async fn environment_selections(&self) -> Vec<TurnEnvironmentSelection> {
         self.session.thread_environment_selections().await
     }