Expose a backend-independent agent control contract (#46547)

## What changed

Add a public, object-safe `AgentControl` trait and request/response types for coordinating an agent tree independently of where its threads run. Define contracts for lifecycle operations, message delivery, status observation, execution admission, usage accounting, shared configuration, and guardian evidence.

Move shared agent types out of the local controller and export them from `codex-core`. Let `AgentExecutionGuard` own a backend-provided reservation while preserving the local limiter's release-on-drop behavior. Include `root_thread_id` in `GuardianRootSnapshot` to identify the source of authorization evidence.

## Testing

Add tests for reservation release when a guard is dropped or a turn is cancelled, and extend the guardian authorization test to assert the root thread identity. Check trait object safety at compile time.

GitOrigin-RevId: 9385c9fbfd189f08429539fd89061ef8c9efe0d9

codex-rs/core/src/codex_thread.rs

@@ -173,6 +173,8 @@ pub struct GuardianAuthorizationVersion {
 /// Bounded root conversation and authorization state from one history snapshot.
 #[derive(Debug, Eq, PartialEq)]
 pub struct GuardianRootSnapshot {
+    /// Authoritative root from which this evidence was captured.
+    pub root_thread_id: ThreadId,
     pub authorization_version: GuardianAuthorizationVersion,
     pub messages: Vec<GuardianRootMessage>,
     pub trusted_skill_paths: Vec<String>,