[codex] define code mode host handshake protocol (#29515)

## Summary

- add validated protocol-version, capability, and session identifier
types
- define explicit `ClientToHost` and `HostToClient` JSON envelopes for
connection negotiation and session open/close acknowledgements
- reject invalid states and unknown fields during decoding, with
explicit wire-format and round-trip coverage

## Why

This establishes the transport-neutral encoding shape needed to build
and test the new code-mode host incrementally. Cell, tool callback, and
failure-domain messages are intentionally deferred until their actors
and behavior tests establish the required semantics.

This is additive protocol scaffolding and does not change the current
production code-mode implementation.

## Validation

codex-rs/code-mode-protocol/src/host/mod.rs

@@ -0,0 +1,29 @@
+//! Transport-neutral messages for the callback-only code-mode host boundary.
+//!
+//! Protocol version 1 relies on ordered framing and connection-scoped
+//! fail-stop behavior rather than message sequence numbers. It defines no
+//! optional capabilities yet; capability names provide an extension point for
+//! later versions without weakening the v1 decoder.
+
+mod error;
+mod message;
+mod types;
+
+pub use error::HandshakeRejectReason;
+pub use message::ClientHello;
+pub use message::ClientHelloError;
+pub use message::ClientToHost;
+pub use message::HostHello;
+pub use message::HostToClient;
+pub use types::Capability;
+pub use types::CapabilitySet;
+pub use types::DuplicateCapability;
+pub use types::InvalidIdentifier;
+pub use types::InvalidSupportedProtocolVersions;
+pub use types::ProtocolVersion;
+pub use types::SessionId;
+pub use types::SupportedProtocolVersions;
+
+#[cfg(test)]
+#[path = "host_tests.rs"]
+mod tests;