Support Daybreak selection in codex exec (#49856)

## What changed

- Add the `daybreak` configuration key, defaulting to `false`, with per-invocation overrides such as `-c daybreak=true`.
- Resolve access programs from the model catalog, preferring `daybreak_blue` over `daybreak_red` when enabled and selecting advertised `standard` access when disabled for signed-in ChatGPT accounts. Require the OpenAI provider, a signed-in ChatGPT account, and a compatible model to enable Daybreak.
- Save the choice for new persistent threads and inherit it on resume and fork, including ephemeral forks. Explicit CLI overrides apply only to the current invocation.

## Testing

Add protocol tests for advertised-program selection and exec integration tests for account and provider restrictions, saved choices, ephemeral forks, and invocation-only overrides.

GitOrigin-RevId: ac955f08b5a891e720cfc5f67fabb7b0f6d32bb8

codex-rs/protocol/src/openai_models/access_programs.rs

@@ -17,6 +17,25 @@ pub struct ModelAccessPrograms {
     pub cyber: Vec<CyberAccessProgram>,
 }
 
+impl ModelAccessPrograms {
+    /// Select the preferred Daybreak treatment advertised for this model.
+    pub fn daybreak(&self) -> Option<CyberAccessProgram> {
+        [
+            CyberAccessProgram::DaybreakBlue,
+            CyberAccessProgram::DaybreakRed,
+        ]
+        .into_iter()
+        .find(|program| self.cyber.contains(program))
+    }
+
+    /// Select the standard treatment when it is advertised.
+    pub fn standard(&self) -> Option<CyberAccessProgram> {
+        self.cyber
+            .contains(&CyberAccessProgram::Standard)
+            .then_some(CyberAccessProgram::Standard)
+    }
+}
+
 fn deserialize_known_cyber_access_programs<'de, D>(
     deserializer: D,
 ) -> Result<Vec<CyberAccessProgram>, D::Error>
@@ -29,3 +48,7 @@ where
         .filter_map(|program| serde_json::from_value(serde_json::Value::String(program)).ok())
         .collect())
 }
+
+#[cfg(test)]
+#[path = "access_programs_tests.rs"]
+mod tests;