Redact OTEL exporter headers in app-server config responses (#57654)

## Why

OTEL exporter headers can contain credentials. Configuration responses exposed these values in effective config, source layers, managed requirements, and write-override metadata.

## What changed

Replace header values with `[redacted]` across these responses for log, trace, and metrics exporters while preserving header names. Keep the original values available to runtime exporters, and redact them in debug output. Update protocol schemas and generated client documentation to describe the redacted values.

## Testing

Add coverage for effective config and source-layer redaction, managed requirements, and single and batch write-override metadata, including header names containing dots. Extend telemetry integration coverage to verify that runtime requests still carry the configured header value.

GitOrigin-RevId: ad24e8b91e615bd36c03c4c0ca205ac64bbd8cbf

codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json

@@ -16553,7 +16553,7 @@
                     "additionalProperties": {
                       "type": "string"
                     },
-                    "description": "Exporter request headers.",
+                    "description": "Header names are retained; values are redacted by the server.",
                     "type": "object"
                   },
                   "protocol": {
@@ -16596,7 +16596,7 @@
                     "additionalProperties": {
                       "type": "string"
                     },
-                    "description": "Exporter request headers.",
+                    "description": "Header names are retained; values are redacted by the server.",
                     "type": "object"
                   },
                   "tls": {

codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json

@@ -12545,7 +12545,7 @@
                   "additionalProperties": {
                     "type": "string"
                   },
-                  "description": "Exporter request headers.",
+                  "description": "Header names are retained; values are redacted by the server.",
                   "type": "object"
                 },
                 "protocol": {
@@ -12588,7 +12588,7 @@
                   "additionalProperties": {
                     "type": "string"
                   },
-                  "description": "Exporter request headers.",
+                  "description": "Header names are retained; values are redacted by the server.",
                   "type": "object"
                 },
                 "tls": {

codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json

@@ -1169,7 +1169,7 @@
                   "additionalProperties": {
                     "type": "string"
                   },
-                  "description": "Exporter request headers.",
+                  "description": "Header names are retained; values are redacted by the server.",
                   "type": "object"
                 },
                 "protocol": {
@@ -1212,7 +1212,7 @@
                   "additionalProperties": {
                     "type": "string"
                   },
-                  "description": "Exporter request headers.",
+                  "description": "Header names are retained; values are redacted by the server.",
                   "type": "object"
                 },
                 "tls": {

codex-rs/app-server-protocol/schema/typescript/v2/OtelExporter.ts

@@ -6,10 +6,10 @@ import type { OtelTlsConfig } from "./OtelTlsConfig";
 
 export type OtelExporter = "none" | "statsig" | { "otlp-http": { endpoint: string,
 /**
- * Exporter request headers.
+ * Header names are retained; values are redacted by the server.
  */
 headers: { [key in string]?: string }, protocol: OtelHttpProtocol, tls: OtelTlsConfig | null, } } | { "otlp-grpc": { endpoint: string,
 /**
- * Exporter request headers.
+ * Header names are retained; values are redacted by the server.
  */
 headers: { [key in string]?: string }, tls: OtelTlsConfig | null, } };