Encapsulate thread metadata construction (#60524)

## What changed

Move `ThreadMetadataBuilder` into its own module, make its fields private, and replace direct field assignments with fluent `with_*` methods. Initialize `updated_at` and `recency_at` from the creation time and default the approval mode to `OnRequest`.

Update `apply_rollout_items` to accept a boxed `ThreadMetadata` seed, keeping callers' async frames small while preserving existing database fields except for the seed rollout path. Add `build_thread_metadata` to use the state runtime's configured provider, and use `thread_id_from_rollout_path` directly for the doctor's filename fallback.

GitOrigin-RevId: a27e4c6b22832e902922dbdd60d7f5c11b4a1a83

codex-rs/cli/src/doctor/thread_inventory.rs

@@ -572,8 +572,8 @@ async fn thread_id_from_rollout(path: &Path) -> RolloutThreadId {
     // Legacy rollouts can omit session metadata, so use the validated filename fallback after
     // the bounded prefix without retaining the first item or loading the full history.
     let logical_path = codex_rollout::plain_rollout_path(path);
-    codex_rollout::builder_from_items(&[], &logical_path)
-        .map(|builder| RolloutThreadId::Id(builder.id.to_string()))
+    codex_rollout::thread_id_from_rollout_path(&logical_path)
+        .map(|id| RolloutThreadId::Id(id.to_string()))
         .unwrap_or(RolloutThreadId::MalformedName)
 }